CVE-2021-34856
📋 TL;DR
This vulnerability in Parallels Desktop allows local attackers with high-privileged code execution on a guest system to escalate privileges to hypervisor level through memory corruption in the virtio-gpu virtual device. It affects Parallels Desktop installations where attackers have already compromised guest systems. The flaw enables arbitrary code execution in the hypervisor context.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete hypervisor compromise allowing attacker to escape guest VM isolation, access host system and other VMs, and execute arbitrary code with highest privileges.
Likely Case
Privilege escalation from compromised guest VM to hypervisor level, enabling persistence, lateral movement to other VMs, and host system access.
If Mitigated
Limited to guest VM compromise without hypervisor escape if proper isolation controls and patching are implemented.
🎯 Exploit Status
Requires existing high-privileged access on guest VM. Memory corruption via improper validation in virtio-gpu device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Parallels Desktop 16.1.4 or later
Vendor Advisory: https://kb.parallels.com/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Help > Check for Updates. 3. Install available updates. 4. Restart Parallels Desktop and affected VMs.
🔧 Temporary Workarounds
Disable virtio-gpu
allRemove or disable virtio-gpu virtual device from VM configuration to eliminate attack vector
prlctl set <VM_ID> --device-set gpu --disable
Isolate guest VMs
allImplement strict network segmentation and limit guest VM privileges
🧯 If You Can't Patch
- Isolate Parallels Desktop host from sensitive networks and systems
- Implement strict access controls and monitoring on guest VMs to prevent initial compromise
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version: Open Parallels Desktop > About Parallels Desktop. If version is 16.1.3 (49160) or earlier, system is vulnerable.Check Version:
prlsrvctl info | grep 'Version:'Verify Fix Applied:
Verify version is 16.1.4 or later in About Parallels Desktop. Check that virtio-gpu device is either updated or disabled in VM configuration.📡 Detection & Monitoring
Log Indicators:
- Unusual virtio-gpu device activity in Parallels logs
- Guest VM privilege escalation attempts
- Hypervisor process anomalies
Network Indicators:
- Unexpected network connections from hypervisor to external systems
- Guest VM attempting hypervisor communication
SIEM Query:
source="parallels*" AND (event="privilege_escalation" OR event="memory_corruption" OR device="virtio-gpu")