Vulnerability Description
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Parallels | Parallels Desktop | 20.1.1_\(55740\) |
Related Weaknesses (CWE)
References
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126ExploitThird Party Advisory
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2126ExploitThird Party Advisory
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126ExploitThird Party Advisory
FAQ
What is CVE-2024-36486?
CVE-2024-36486 is a vulnerability with a CVSS score of 7.8 (HIGH). A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, ...
How severe is CVE-2024-36486?
CVE-2024-36486 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-36486?
Check the references section above for vendor advisories and patch information. Affected products include: Parallels Parallels Desktop.