EUVD-2024-54643CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.
Analysis
Privilege escalation vulnerability in Parallels Desktop for Mac 20.1.1 that allows a local attacker with user-level privileges to gain root-level code execution through a hard link attack during virtual machine archive restoration. The prl_vmarchiver tool operates with root privileges during decompression and file restoration, enabling an attacker to redirect writes to arbitrary system files. This vulnerability has a CVSS score of 7.8 (High) with low attack complexity, making it a practical privilege escalation vector for local users on affected systems.
Technical Context
The vulnerability resides in the virtual machine archive restoration functionality of Parallels Desktop, specifically the prl_vmarchiver utility. The root cause is classified under CWE-62 (Improper Validation of a Pathname for a Restricted Directory), which encompasses insecure handling of symlinks and hard links during file operations. When restoring archived VMs, prl_vmarchiver decompresses content with elevated (root) privileges and writes files to their original locations without proper validation of pathname integrity. An attacker can exploit this by creating hard links that point to sensitive system files (e.g., /etc/sudoers, system binaries, or configuration files). When the restoration process follows the hard link and writes VM content, it effectively modifies arbitrary system files with root privileges. This is a classic time-of-check-time-of-use (TOCTOU) and insecure symlink/hardlink handling pattern. Affected: CPE:2.3:a:parallels:parallels_desktop:20.1.1:*:*:*:*:mac:*:* (version 55740).
Affected Products
- vendor: Parallels; product: Parallels Desktop for Mac; version: 20.1.1; build: 55740; cpe: cpe:2.3:a:parallels:parallels_desktop:20.1.1:*:*:*:*:mac:*:*; platform: macOS; status: Vulnerable
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today