CVE-2021-31424
📋 TL;DR
This is a heap-based buffer overflow vulnerability in Parallels Desktop's Open Tools Gate component that allows local attackers to escalate privileges from guest systems to hypervisor level. Attackers must first gain low-privileged code execution on a guest VM to exploit this flaw. The vulnerability affects Parallels Desktop installations on macOS hosts running Windows or Linux guest VMs.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the hypervisor allowing attacker to execute arbitrary code with hypervisor privileges, potentially compromising all guest VMs and the host system.
Likely Case
Privilege escalation from guest VM user to hypervisor level, enabling lateral movement to other VMs or host system compromise.
If Mitigated
Limited to guest VM compromise only if proper network segmentation and hypervisor hardening are implemented.
🎯 Exploit Status
Requires initial access to guest VM with ability to execute code. The ZDI advisory suggests reliable exploitation is possible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Parallels Desktop 16.5.0 or later
Vendor Advisory: https://kb.parallels.com/en/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Parallels Desktop menu > Check for Updates. 3. Install update to version 16.5.0 or later. 4. Restart Parallels Desktop and affected guest VMs.
🔧 Temporary Workarounds
Disable Parallels Tools in Guest VMs
allRemove or disable Parallels Tools from guest VMs to eliminate the vulnerable component
In guest VM: Control Panel > Programs > Uninstall Parallels Tools
Network Segmentation
allIsolate guest VMs from critical networks and restrict guest-to-host communication
🧯 If You Can't Patch
- Implement strict access controls to guest VMs and monitor for unauthorized access
- Segment virtualization environment from production networks and implement network monitoring
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version: In macOS, open Parallels Desktop > About Parallels Desktop. If version is 15.1.5-47309 or earlier, system is vulnerable.Check Version:
On macOS host: /Applications/Parallels\ Desktop.app/Contents/MacOS/prlsrvctl -VVerify Fix Applied:
Verify version is 16.5.0 or later in About Parallels Desktop dialog.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Parallels Tools components
- Buffer overflow attempts in guest VM logs
- Privilege escalation attempts from guest to host
Network Indicators:
- Unusual guest-to-host communication patterns
- Suspicious inter-VM communication
SIEM Query:
source="parallels*" AND (event_type="privilege_escalation" OR event_type="buffer_overflow")