Lucene search

ZdiCVE-2021-31422

HistoryApr 29, 2021 - 5:15 p.m.

CVE-2021-31422

2021-04-2917:15:09

CWE-367

CWE-667

zdi

web.nvd.nist.gov

cve-2021-31422

parallels desktop

privilege escalation

e1000e virtual device

security vulnerability

nvd

zdi-can-12527

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

15.9%

JSON

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.1-49141. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the e1000e virtual device. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-12527.

Affected configurations

Nvd

Vulners

Node

parallelsparallels_desktopMatch16.1.1-49141

VendorProductVersionCPE
parallelsparallels_desktop16.1.1-49141cpe:2.3:a:parallels:parallels_desktop:16.1.1-49141:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
parallels	parallels_desktop	16.1.1-49141	cpe:2.3:a:parallels:parallels_desktop:16.1.1-49141:::::::*

CNA Affected

[
  {
    "product": "Desktop",
    "vendor": "Parallels",
    "versions": [
      {
        "status": "affected",
        "version": "16.1.1-49141"
      }
    ]
  }
]

References

kb.parallels.com/en/125013

www.zerodayinitiative.com/advisories/ZDI-21-430/

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

15.9%

JSON

Related for CVE-2021-31422