CVE-2021-31422
📋 TL;DR
This vulnerability allows local attackers with high-privileged code execution on a Parallels Desktop guest system to escalate privileges to hypervisor level through a race condition in the e1000e virtual device. It affects Parallels Desktop installations where untrusted users have access to guest VMs. The flaw results from improper locking mechanisms during object operations.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the hypervisor host system, allowing arbitrary code execution at the highest privilege level, potentially leading to host takeover and compromise of all guest VMs.
Likely Case
Privilege escalation from guest VM administrator to hypervisor-level access, enabling lateral movement to other VMs and host system compromise.
If Mitigated
Limited to guest VM isolation breach without host compromise if proper network segmentation and hypervisor hardening are implemented.
🎯 Exploit Status
Requires existing high-privileged access on guest VM. Exploitation involves race condition timing, making it moderately complex but feasible for skilled attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.1.2-49153 and later
Vendor Advisory: https://kb.parallels.com/en/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Help → Check for Updates. 3. Install update 16.1.2-49153 or later. 4. Restart all running VMs and the host system.
🔧 Temporary Workarounds
Disable e1000e network adapter
allReplace e1000e virtual network adapter with alternative adapter types in VM configuration
Restrict guest VM privileges
allLimit user access to guest VMs and remove administrative privileges where possible
🧯 If You Can't Patch
- Isolate vulnerable VMs on separate network segments to limit lateral movement
- Implement strict access controls and monitoring for guest VM administrative activities
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version: Open Parallels Desktop → About Parallels Desktop. If version is 16.1.1-49141 or earlier, system is vulnerable.Check Version:
On macOS terminal: /Applications/Parallels\ Desktop.app/Contents/MacOS/prlsrvctl info | grep VersionVerify Fix Applied:
Verify version is 16.1.2-49153 or later in About Parallels Desktop dialog.📡 Detection & Monitoring
Log Indicators:
- Unusual hypervisor process activity
- Guest VM attempting privileged operations outside normal scope
- Race condition patterns in virtualization logs
Network Indicators:
- Unexpected network traffic between VMs and hypervisor management interfaces
SIEM Query:
source="parallels*" AND (event_type="privilege_escalation" OR process_name="e1000e")