Two different exploits for a vulnerability in Parallels Desktop have been publicly disclosed, allowing malicious hackers to gain root access to Mac devices.
Parallels Desktop is a virtualization software that allows Mac users to run Windows, Linux, and other operating systems alongside macOS.
Security researcher Mickey Jin published the exploits last week, offering a workaround for the previously released patches for the CVE-2024-34331 (elevation of privilege) vulnerability in Parallels Desktop for Mac, which was discovered in May 2024 by Mykola Grymalyuk.
Jin says he released the exploits for the zero-day patch bypass, after the developer allegedly left it unpatched for more than seven months.
See also: Confluence Server vulnerability allows LockBit Ransomware attacks
“Since the vendor had left this vulnerability for over seven months – despite the previous disclosure – I chose to publicly disclose this 0-day exploit,” explains Jin.
“My goal is to raise awareness and encourage users to proactively mitigate risks, as attackers could exploit this vulnerability.“.
Bypassing the fix in Parallels Desktop
The initial update to Parallels Desktop attempted to prevent untrusted code from running by verifying whether the "createinstallmedia" tool is signed by Apple before granting it root privileges.
However, Jin showed that this verification is flawed, allowing attackers to bypass it in at least two ways.
The first involves performing a time-of-check to time-of-use (TOCTOU) attack to exploit a race condition between checking for 'createinstallmedia' and executing it with root privileges.
See also: Wireshark 4.4.4: Fixes vulnerability that triggers DoS attack
An attacker installs a fake macOS installer, waits for Parallels to verify the Apple-signed 'createinstallmedia' binary, and then quickly replaces it with a malicious script before executing, gaining root privileges.
The second exploit is an attack via the 'do_repack_manual' function, which is vulnerable to root-own file overwrites.
By exploiting the 'do_repack_manual' function, an attacker redirects a privileged folder using symlinks, tricks Parallels Desktop into writing files controlled by the attacker to a root-owned path, and replaces 'p7z_tool', which runs as root.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Jin discovered the potential bypasses soon after Mykola's report and notified Parallels Desktop developers in June 2024. The researcher says the vendor promised to look into his report, but despite three successive requests for an update (the last one was on February 19, 2025), he received no response.
The first exploit works in the latest version of Parallels, 20.2.1 (55876) and in all versions from 19.4.0 and older.
Parallels modified the repacking process in version 19.4.1, changing from 'do_repack_createinstallmedia' to 'do_repack_manual', breaking the exploit.
However, this change introduced a new vulnerability that allows an attacker to replace arbitrary root-owned files, making the second exploit possible.
See also: CISA: CMS Craft vulnerability exploited in attacks
The changes were reverted to the latest version (20.2.1), so the exploit works again.
In conclusion, all known versions of Parallels Desktop, including the most recent one, are vulnerable to at least one of the two exploits.
Privilege elevation vulnerabilities are a serious threat in today's digital landscape. It is vital for organizations to remain vigilant and implement strong security measures to protect against such attacks. Organizations should constantly stay updated on new patches and apply them as soon as they are released.
Source: www.bleepingcomputer.com
