Alludo Parallels Desktop Privilege Escalation Vulnerability on Intel Macs

A privilege escalation vulnerability allowing users to gain root access has been identified in Alludo Parallels Desktop versions prior to 19.4.2 and in the 20.x series prior to 20.2.2. This vulnerability affects macOS on Intel platforms and arises during the virtual machine creation process.

Impact

Exploitation of this vulnerability allows a user with access to the Mac, but without root privileges, to gain root access by manipulating the Parallels Desktop virtual machine creation routine.

Remediation

Users are advised to update Parallels Desktop to version 20.2.2 or 19.4.2. Instructions for updating can be found in the Parallels Desktop application under 'Check for updates'.