CVE-2021-34987
📋 TL;DR
This is a buffer overflow vulnerability in Parallels Desktop's HDAudio virtual device that allows local attackers with high-privileged code execution on a guest system to escalate privileges to hypervisor level. It affects Parallels Desktop installations where attackers can already execute code on guest virtual machines. The vulnerability enables arbitrary code execution in the hypervisor context.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the hypervisor allowing attacker to escape guest VM isolation, access host system and other VMs, and execute arbitrary code with hypervisor privileges.
Likely Case
Privilege escalation from guest VM to hypervisor level, enabling persistence, lateral movement to other VMs, and host system compromise.
If Mitigated
Limited impact if guest VMs are properly isolated and attackers cannot obtain initial high-privileged code execution on guest systems.
🎯 Exploit Status
Requires attacker to first obtain high-privileged code execution on target guest system. Exploit involves triggering buffer overflow in HDAudio device driver.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Parallels Desktop 17.0.0 or later
Vendor Advisory: https://kb.parallels.com/en/125013
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Help > Check for Updates. 3. Install available updates. 4. Restart Parallels Desktop and affected virtual machines.
🔧 Temporary Workarounds
Disable HDAudio virtual device
allRemove or disable the HDAudio virtual device from vulnerable virtual machines
1. Shut down the VM. 2. Open VM configuration. 3. Navigate to Hardware > Sound. 4. Change sound device type from 'HDAudio' to 'None' or alternative.
Restrict guest VM privileges
allImplement strict access controls on guest VMs to prevent attackers from obtaining high-privileged code execution
Implement least privilege principles, disable unnecessary services, use application whitelisting, and enforce strong authentication on guest VMs.
🧯 If You Can't Patch
- Isolate vulnerable VMs from critical systems and networks
- Implement strict monitoring and logging for suspicious activity on guest VMs
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version: In Parallels Desktop, go to About Parallels Desktop. If version is 16.5.1 (49187) or earlier, system is vulnerable.Check Version:
In macOS Terminal: /usr/libexec/PlistBuddy -c 'Print :CFBundleShortVersionString' /Applications/Parallels\ Desktop.app/Contents/Info.plistVerify Fix Applied:
Verify Parallels Desktop version is 17.0.0 or later. Check that HDAudio device is either updated or disabled in VM configuration.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Parallels components
- Crash logs from Parallels kernel extensions
- Suspicious hypervisor-level activity
Network Indicators:
- Unusual network traffic from Parallels processes
- Unexpected connections between VMs or to host
SIEM Query:
source="parallels*" AND (event_type="crash" OR process_name="*hdaudio*" OR severity="high")