- A researcher claims a fix for an older Parallels Desktop flaw doesn’t work properly
- There are multiple ways to bypass it and gain access to the root device
- The bypass works on the latest version of the tool
Parallels Desktop apparently has some worrying flaws which could put Mac users at serious risk attack. The flaws were first spotted in mid-2024, and after not being properly fixed, a researcher decided to publish working exploits.
Parallels Desktop is a virtualization software allowing Mac users to run Windows, Linux, and other operating systems alongside macOS without rebooting. It offers seamless integration, enabling users to switch between operating systems effortlessly, share files, and run Windows applications as if they were native Mac apps.
In May 2024, a researcher called Mykola Grymalyuk discovered the program did not have code signature verification, resulting in a privilege elevation flaw now tracked as CVE-2024-34331. After disclosing the findings to Parallels Desktop, the developers issued a fix in September of the same year. Soon after, another researcher – Mickey Jin – analyzed the patch and came to the conclusion that there are workarounds.
Microsoft 365
Jin then reached out to the company, and despite being given assurances that his research will be scrutinized, that never happened. Now, seven months later, to force their hand, Jin released two exploits.
“Given that the vendor has left this vulnerability unaddressed for over seven months—despite prior disclosure—I have chosen to publicly disclose this 0-day exploit,” Jin said in his analysis. “My goal is to raise awareness and urge users to mitigate risks proactively, as attackers could leverage this flaw in the wild.”
Jin found two ways to abuse the flaw. One is to perform a time-of-check to time-of-use (TOCTOU) attack to exploit a race condition between checking if ‘createinstallmedia’ is Apple-signed and executing it with root privileges. The second one is via the ‘do_repack_manual’ function, which seems to be vulnerable to arbitrary root-own file overwrites.
The TOCTOU attack works on the latest version of Parallels, Jin said. Older versions are vulnerable to different methods.
Via BleepingComputer
Leave a comment