CVE-2021-34868
📋 TL;DR
This vulnerability in Parallels Desktop allows local attackers to escalate privileges from a guest VM to the hypervisor. Attackers must first execute low-privileged code on the guest system, then exploit a memory allocation flaw in the Toolgate component to execute arbitrary code with hypervisor privileges. Affects Parallels Desktop users running vulnerable versions.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
Parallels by Parallels
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the hypervisor and host system, allowing attacker to escape VM isolation, access all VMs, and control the physical host.
Likely Case
Privilege escalation within the guest VM to hypervisor-level access, potentially compromising other VMs on the same host.
If Mitigated
Limited to guest VM compromise if proper network segmentation and least privilege are implemented.
🎯 Exploit Status
Requires local code execution in guest VM first; ZDI advisory exists but no public exploit code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.1.4 or later
Vendor Advisory: https://kb.parallels.com/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Help > Check for Updates. 3. Install update to version 16.1.4 or later. 4. Restart all running VMs and the host system.
🔧 Temporary Workarounds
Disable Parallels Tools in Guest VMs
allRemove or disable Parallels Tools/Toolgate component in guest VMs to eliminate attack surface
Within guest VM: Uninstall Parallels Tools via Add/Remove Programs (Windows) or package manager (Linux)
Restrict Guest VM Privileges
allConfigure guest VMs with minimal privileges and no local admin rights
🧯 If You Can't Patch
- Isolate vulnerable VMs on separate network segments from critical systems
- Implement strict monitoring for unusual guest VM activity and privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version: In macOS, open Parallels Desktop > About Parallels Desktop. If version is 16.1.3-49160 or earlier, system is vulnerable.Check Version:
On macOS host: /Applications/Parallels\ Desktop.app/Contents/MacOS/prlctl --versionVerify Fix Applied:
Verify version is 16.1.4 or later in About Parallels Desktop dialog.📡 Detection & Monitoring
Log Indicators:
- Unusual Toolgate component activity in Parallels logs
- Guest VM processes attempting hypervisor calls
- Privilege escalation attempts within guest VMs
Network Indicators:
- Guest VM making unexpected network connections to host system
SIEM Query:
source="parallels*" AND (event="toolgate*" OR event="privilege*escalation*")