CVE-2024-6154
📋 TL;DR
This is a heap-based buffer overflow vulnerability in Parallels Desktop's Toolgate component that allows local attackers to escalate privileges. Attackers who already have high-privileged code execution on a guest VM can exploit this to execute arbitrary code on the host system. Only Parallels Desktop installations with vulnerable versions are affected.
💻 Affected Systems
- Parallels Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full host system compromise with attacker gaining root/administrator privileges, allowing complete control over the host operating system and all VMs.
Likely Case
Local privilege escalation from guest VM to host system, enabling attackers to install malware, steal data, or pivot to other systems on the network.
If Mitigated
No impact if proper patch is applied or vulnerable component is disabled/isolated.
🎯 Exploit Status
Exploitation requires attacker to first obtain high-privileged code execution on guest VM. The buffer overflow itself is likely straightforward once initial access is achieved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in CVE, check Parallels Desktop updates
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-24-804/
Restart Required: Yes
Instructions:
1. Open Parallels Desktop. 2. Go to Help → Check for Updates. 3. Install any available updates. 4. Restart Parallels Desktop and affected VMs.
🔧 Temporary Workarounds
Disable Toolgate component
allDisable the vulnerable Toolgate component if not required for your use case
Isolate guest VMs
allEnsure guest VMs are properly isolated and don't have unnecessary privileges or network access
🧯 If You Can't Patch
- Restrict access to guest VMs to trusted users only
- Implement strict monitoring for suspicious activity on guest VMs and host system
🔍 How to Verify
Check if Vulnerable:
Check Parallels Desktop version and compare against patched versions in vendor advisoryCheck Version:
In Parallels Desktop: Help → About Parallels DesktopVerify Fix Applied:
Verify Parallels Desktop is updated to latest version and no security updates are pending📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from Parallels Desktop components
- Suspicious memory allocation patterns in Parallels processes
- Unexpected privilege escalation events
Network Indicators:
- Unusual network traffic from guest VM to host system components
SIEM Query:
Process creation where parent process contains 'prl' and child process has elevated privileges