Local Privilege Escalation in Parallels Desktop by Parallels

CVE-2022-34889

What is CVE-2022-34889?

This vulnerability permits local attackers to escalate their privileges on affected Parallels Desktop installations. An attacker must first gain the ability to execute high-privilege code on the targeted guest system for successful exploitation. The flaw resides in the ACPI virtual device, stemming from inadequate validation of user-supplied data, potentially allowing a read past the end of an allocated buffer. Consequently, an attacker might leverage this vulnerability to escalate their privileges, executing arbitrary code within the hypervisor's context.

References