CVE-2021-34856: (Pwn2Own) Parallels Desktop virtio-gpu Memory Corruption Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the virtio-gpu virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13581.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the virtio-gpu virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-34856?
CVE-2021-34856 is a vulnerability in Parallels Desktop that allows local attackers to escalate privileges on affected installations.
How can this vulnerability be exploited?
To exploit CVE-2021-34856, an attacker must first obtain the ability to execute high-privileged code on the target guest system.
What is the severity of CVE-2021-34856?
CVE-2021-34856 has a severity rating of 8.8 (high).
Which software versions are affected by CVE-2021-34856?
CVE-2021-34856 affects Parallels Desktop 16.1.3 (49160).
How can I fix CVE-2021-34856?
To fix CVE-2021-34856, it is recommended to update to the latest version of Parallels Desktop and apply any available patches or security updates.