Shulou(Shulou.com)06/01 Report--

What is the meaning of Parallels Desktop virtual machine escape vulnerability CVE-2020-8871? for this question, this article introduces the corresponding analysis and solution in detail, hoping to help more partners who want to solve this problem to find a more simple and feasible method.

0x00 vulnerability background

On May 25, 2020, 360CERT Monitoring found that ZDI issued a risk notice of the Parallels Desktop (PD) virtual machine escape vulnerability, the vulnerability number is CVE-2020-8871, vulnerability level: medium danger.

Parallels Desktop is the most popular virtual machine software under the MacOS platform, which aims to provide high-performance virtual machine services.

Parallels Desktop has a memory out-of-bounds vulnerability (Out-Of-Bounds (OOB)) when virtualizing VGA devices, and an attacker can cause the virtual machine to escape (execute arbitrary code on the real physical host and gain control of the physical host) by running a special program inside the virtual machine (requiring virtual machine privileges).

In this regard, 360CERT recommends that the majority of users timely install the latest patches, do a good job of asset self-examination and prevention work, so as to avoid hacker attacks.

0x01 risk rating

360CERT's assessment of the vulnerability is as follows

Assessment method level threat level medium risk influence surface limited 0x02 influence version

Parallels Desktop:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.