Parallels Desktop Flaw Grants Root Access on Macs

A critical security vulnerability has been identified in Parallels Desktop for Mac, a popular virtualization software that enables users to run other operating systems, such as Windows, on their macOS devices. Software company JFrog reported this week that the flaw allows a standard local user account, which typically has limited privileges, to execute code with root-level access. Root access is the highest level of administrative privilege on a macOS system, granting complete control over the operating system and all its files. This means an attacker with initial access to a Mac running a vulnerable version of Parallels Desktop could potentially escalate their privileges to gain full administrative control.

The exploit requires that malicious code is already running on the machine as a normal user. This prerequisite means the vulnerability cannot be exploited remotely over a network. Instead, an attacker would need to trick a user into running a malicious application or script on their Mac, or already have some form of non-administrative access to the system. Once the malicious code is running, it can then leverage the Parallels Desktop flaw to elevate its privileges to root. This could enable the attacker to install malware, steal sensitive data, modify system settings, or disrupt the normal operation of the Mac.

JFrog stated that a fix for this vulnerability is available in Parallels Desktop version 27. However, a significant limitation exists for users of Intel-based Macs. According to JFrog's report, Intel Macs are unable to install this specific version of the Parallels Desktop software. This means that users with Intel Macs running older, vulnerable versions of Parallels Desktop are currently without a patch for this critical security issue. The implications for these users are substantial, as their systems remain exposed to privilege escalation attacks if they fall victim to initial code execution.

The discovery was made by Yuval Moravchick, who leads JFrog's security research team. JFrog is a company specializing in DevOps and security solutions, providing tools for software development and security testing. Their research into Parallels Desktop highlights the ongoing challenges in securing complex software environments, particularly those that bridge different operating systems. The inability to patch Intel Macs suggests a potential architectural difference or compatibility issue that prevents the application of the security update. This situation leaves a segment of Parallels Desktop users in a precarious security position, underscoring the importance of timely updates and cross-platform compatibility in security patches.