CVE-2021-31426
📋 TL;DR
This vulnerability in Parallels Desktop allows local attackers with initial low-privileged access to escalate privileges to kernel-level execution through an integer overflow in the Parallels Tools component. It affects Parallels Desktop installations on macOS systems running vulnerable versions. Attackers can execute arbitrary code in the kernel context of the guest virtual machine.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the guest virtual machine with kernel-level code execution, potentially leading to host system compromise if additional vulnerabilities exist.
Likely Case
Privilege escalation within the guest virtual machine allowing attackers to bypass security controls and access sensitive data.
If Mitigated
Limited impact if proper access controls prevent local code execution or if the vulnerability is patched.
🎯 Exploit Status
Requires local access and ability to execute low-privileged code first. The integer overflow requires specific conditions to trigger.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Parallels Desktop 16.1.3 or later
Vendor Advisory: https://kb.parallels.com/en/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Parallels Desktop menu > Check for Updates. 3. Install available updates. 4. Restart affected virtual machines.
🔧 Temporary Workarounds
Disable Parallels Tools
allRemove or disable Parallels Tools from guest virtual machines to eliminate the vulnerable component.
Within guest VM: Uninstall Parallels Tools using the appropriate uninstaller
Restrict Local Access
allImplement strict access controls to prevent unauthorized local code execution on guest systems.
🧯 If You Can't Patch
- Isolate vulnerable virtual machines from sensitive networks and systems
- Implement application whitelisting to prevent execution of unauthorized code on guest systems
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version: In macOS, open Parallels Desktop > About Parallels Desktop. If version is 16.1.2-49151 or earlier, system is vulnerable.Check Version:
On macOS host: /Applications/Parallels\ Desktop.app/Contents/MacOS/prlsrvctl -VVerify Fix Applied:
Verify Parallels Desktop version is 16.1.3 or later. Check that all virtual machines have been restarted after update.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts in guest system logs
- Kernel module loading anomalies in guest OS
Network Indicators:
- Unusual outbound connections from guest VM after local access
SIEM Query:
source="guest-vm-logs" AND (event_type="privilege_escalation" OR process_name="parallels-tools")