CVE-2021-31420
📋 TL;DR
This is a local privilege escalation vulnerability in Parallels Desktop's Toolgate component. Attackers with low-privileged access to a guest VM can exploit a stack-based buffer overflow to execute arbitrary code with hypervisor privileges. Only affects Parallels Desktop installations with vulnerable versions.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the hypervisor host system, allowing attackers to escape the VM sandbox and gain full control over the host operating system.
Likely Case
Privilege escalation within the guest VM to hypervisor-level access, potentially leading to host system compromise if combined with other vulnerabilities.
If Mitigated
Limited to guest VM compromise without host escape if proper isolation controls are in place.
🎯 Exploit Status
Requires existing low-privileged access to guest VM. ZDI advisory suggests exploit is reliable but requires specific conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.1.1-49151 and later
Vendor Advisory: https://kb.parallels.com/en/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Help > Check for Updates. 3. Install update to version 16.1.1-49151 or later. 4. Restart all VMs and the host system.
🔧 Temporary Workarounds
Disable Toolgate component
allTemporarily disable the vulnerable Toolgate component to prevent exploitation
Not recommended as it breaks VM functionality
🧯 If You Can't Patch
- Isolate vulnerable VMs from critical systems
- Restrict user access to guest VMs to trusted personnel only
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version: In macOS, open Parallels Desktop > About Parallels DesktopCheck Version:
On macOS: /Applications/Parallels\ Desktop.app/Contents/MacOS/prlsrvctl -VVerify Fix Applied:
Verify version is 16.1.1-49151 or higher in About Parallels Desktop📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Parallels tools
- Toolgate component crashes
- Privilege escalation attempts in guest VM logs
Network Indicators:
- Not applicable - local exploit only
SIEM Query:
Process creation where parent process contains 'prl' and child process has elevated privileges