CVE-2020-8873CWE-367

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123

High · published March 23, 2020

CVSS v3.0
8.2
EPSS
0%
Percentile
29.8
In the wild
Unconfirmed
What it is

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the xHCI component. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of the hypervisor. Was ZDI-CAN-10031.

The record
Technical detail
CVSS v3.0
8.2 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.8th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2020-03-23T17:30Z
EPSS history
Timeline
  • 23 MAR 17:30Z
    This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123
    cvelistv5