CVE-2021-3747
📋 TL;DR
This vulnerability in Multipass for macOS allows local privilege escalation due to incorrect directory ownership. An attacker with local access can modify application files to execute arbitrary code with elevated privileges. Only macOS users running Multipass version 1.7.0 are affected.
💻 Affected Systems
- Multipass
📦 What is this software?
Multipass by Canonical
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through privilege escalation leading to root access, data theft, and persistent backdoor installation.
Likely Case
Local attacker gains elevated privileges to modify system files, install malware, or access sensitive data from other user accounts.
If Mitigated
Limited impact if proper access controls and monitoring are in place, though privilege escalation risk remains.
🎯 Exploit Status
Exploitation requires local access to the system. The vulnerability is straightforward to exploit once local access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.2
Vendor Advisory: https://github.com/canonical/multipass/issues/2261
Restart Required: No
Instructions:
1. Update Multipass to version 1.7.2 or later. 2. Run: brew upgrade multipass (if installed via Homebrew). 3. Alternatively, download the latest version from the official Multipass releases page.
🔧 Temporary Workarounds
Manual directory ownership correction
macosManually set correct ownership on Multipass application directories
sudo chown -R root:wheel /Applications/Multipass.app
sudo chmod -R 755 /Applications/Multipass.app
🧯 If You Can't Patch
- Restrict local access to affected systems and implement strict user privilege separation
- Monitor for unauthorized file modifications in Multipass application directories
🔍 How to Verify
Check if Vulnerable:
Check Multipass version: multipass version. If output shows 1.7.0, system is vulnerable.Check Version:
multipass versionVerify Fix Applied:
After update, verify version is 1.7.2 or later: multipass version. Also check directory ownership: ls -la /Applications/Multipass.app📡 Detection & Monitoring
Log Indicators:
- Unauthorized file modifications in /Applications/Multipass.app directory
- Unexpected privilege escalation attempts
Network Indicators:
- None - this is a local privilege escalation vulnerability
SIEM Query:
Process creation events showing unexpected privilege escalation or file modification in Multipass directories