Parallels Desktop Updater Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

CVE-2023-27323

What is CVE-2023-27323?

A local privilege escalation vulnerability exists in the Updater service of Parallels Desktop, allowing local attackers to execute arbitrary code with elevated privileges. To exploit this vulnerability, an attacker must first gain the ability to run low-privileged code on the target host system. The flaw is specifically tied to the improper handling of symbolic links in the Updater service. When an attacker creates a symbolic link pointing to a malicious file, they can leverage this vulnerability to escalate their privileges and execute code in the context of the root user. The impact of this vulnerability is significant, enabling unauthorized access and control over the host system.

References