Parallels Desktop is the leading macOS desktop hypervisor, running Windows and Linux VMs with device emulation and integration services hosted in Parallels' own processes (the prl_* family) on the macOS host. A guest-to-host escape corrupts one of those host-side components and runs on macOS. The attack surface is the emulated device set and, prominently, the Parallels Tools integration, shared folders, the shared clipboard, and drag-and-drop, carried over Parallels' guest-host communication channels. Parallels is a recurring Pwn2Own target, with escapes repeatedly found in both the device models and the Tools integration.
# from the guest: emulated devices and Parallels Tools
lspci -nn 2>/dev/null; lsusb 2>/dev/null # Linux guest
# Parallels Tools present (guest integration drivers/services)
lsmod 2>/dev/null | grep -i prl
Subtopics#
- Guest-to-host escape: breaking out through emulated devices.
- Shared folder and clipboard abuse: the Parallels Tools integration surface.
- Known escape exploits: the recurring device and Tools bugs.