CVE-2024-36486
📋 TL;DR
This CVE describes a privilege escalation vulnerability in Parallels Desktop for Mac where the prl_vmarchiver tool writes decompressed archive contents with root privileges. Attackers can exploit this using hard links to overwrite arbitrary files, potentially gaining root access. Only users running Parallels Desktop for Mac version 20.1.1 (55740) are affected.
💻 Affected Systems
- Parallels Desktop for Mac
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges achieved through arbitrary file write leading to complete control of the macOS system.
Likely Case
Local privilege escalation allowing an attacker with user-level access to gain root privileges on the affected system.
If Mitigated
No impact if the vulnerable version is not installed or if proper access controls prevent local user exploitation.
🎯 Exploit Status
Exploitation requires local access and knowledge of hard link techniques to manipulate file writes during VM archive restoration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to latest version (beyond 20.1.1)
Vendor Advisory: https://www.parallels.com/products/desktop/security/
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Parallels Desktop menu > Check for Updates. 3. Install available updates. 4. Restart your Mac if prompted.
🔧 Temporary Workarounds
Disable Parallels Desktop VM archive functionality
allPrevent use of the vulnerable prl_vmarchiver tool by restricting VM archive operations
Restrict prl_vmarchiver permissions
linuxChange permissions on the prl_vmarchiver binary to prevent execution
sudo chmod 000 /Applications/Parallels\ Desktop.app/Contents/MacOS/prl_vmarchiver
🧯 If You Can't Patch
- Restrict local user access to systems running vulnerable Parallels Desktop
- Implement strict file integrity monitoring for critical system files
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version in About Parallels Desktop menu. If version is 20.1.1 (55740), system is vulnerable.Check Version:
grep -i version /Applications/Parallels\ Desktop.app/Contents/Info.plistVerify Fix Applied:
Verify Parallels Desktop version is updated beyond 20.1.1 (55740) and check that prl_vmarchiver tool no longer writes with root privileges during archive restoration.📡 Detection & Monitoring
Log Indicators:
- Unusual prl_vmarchiver process execution
- Unexpected file modifications in system directories during VM operations
Network Indicators:
- None - this is a local privilege escalation
SIEM Query:
process_name="prl_vmarchiver" AND user="root" AND file_write_operation=*