Bash Privileged-Mode Vulnerabilities in Parallels Desktop and CDPATH Handling in MacOS

In the last few years, we have seen multiple vulnerabilities in Parallels Desktop leading to virtual machine escapes. Interested readers can check our previous blog posts about vulnerabilities across interfaces such as RDPMC hypercalls, the Parallels ToolGate, and the VGA virtual device. This post explores another set of issues we received last year - local privilege escalations through setuid root binaries.

Parallels Desktop has a couple of setuid binaries: prl_update_helper and Parallels Service. Both binaries run with …

bash blog blog posts check desktop device handling local machine macos mode parallels privilege privileged privileges root run scripts service setuid vga virtual virtual machine vulnerabilities