Parallels Desktop Flaw Lets Non-Admin Mac Users Gain Root, but Intel Macs Can't Install Fix
-
Parallels Desktop for Mac carries a local privilege escalation flaw that allows a standard, non-administrative user account to execute code as root, according to research published this week by JFrog.
The vulnerability is not remotely exploitable. An attacker must already have code running on the target machine under a normal user context before the flaw can be leveraged, which limits it to scenarios where an adversary has some form of existing local access.
- Exploitation requires pre-existing code execution as a regular user
- Attack path is local only; it cannot be triggered over the network
- Successful exploitation yields root, the highest privilege level on macOS
A fix is available in Parallels Desktop 27. However, Intel Macs cannot install that release, leaving owners of those systems without a supported patched version.
The research was led by Yuval Moravchick of JFrog.
Source: The Hacker News
If your fleet still includes Intel Macs running Parallels Desktop, how are you handling the lack of a patched release?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login