Overview
The cybersecurity landscape is fraught with potential pitfalls and vulnerabilities, one of which has recently emerged in the form of CVE-2024-52561. This is a privilege escalation vulnerability that has been identified in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). The vulnerability has significant implications for Mac users who rely on Parallels Desktop for running virtual machines, as it exposes them to potential system compromise and data leakage. The severity and potential impact of this vulnerability underline the critical need for timely mitigation measures.
Vulnerability Summary
CVE ID: CVE-2024-52561
Severity: High (7.8 CVSS Severity Score)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Parallels Desktop for Mac | 20.1.1 (build 55740)
How the Exploit Works
When a snapshot of a virtual machine is deleted in the vulnerable version of Parallels Desktop for Mac, a root service verifies and modifies the ownership of the snapshot files. Herein lies the vulnerability: an attacker can exploit this functionality by using a symlink to change the ownership of root-owned files to a lower-privilege user. This manipulation can lead to privilege escalation, potentially allowing the attacker to execute actions with administrative privileges.
Conceptual Example Code
An attacker might exploit this vulnerability using a shell command like the conceptual example below:
# Create a symbolic link to a root-owned file
ln -s /root/owned/file /path/to/snapshot/files
# Trigger the deletion of a snapshot
# The root service verifies and modifies the ownership of the snapshot files,
# inadvertently changing the ownership of the root-owned file due to the symlink.
delete_snapshotMitigation Guidance
Users of Parallels Desktop for Mac version 20.1.1 (build 55740) are advised to apply the vendor patch to mitigate this vulnerability. If the patch cannot be applied immediately, interim measures such as deploying a Web Application Firewall (WAF) or Intrusion Detection System (IDS) could serve as temporary mitigation. However, such measures will not completely eliminate the risk, and the patch should be applied as soon as practicable.
In the longer term, organizations should also consider implementing a robust vulnerability management program that includes regular scanning and patching to minimize the risk of exposure to such vulnerabilities.