CVE-2014-1372

Vulnerability

The vulnerability resides in the Graphics Driver component of Apple OS X. During processing of an unspecified system call, the driver does not properly restrict read operations, allowing a local user to access sensitive kernel memory. This issue affects OS X Mavericks versions before 10.9.4, as well as earlier versions such as OS X Lion v10.7.5 and OS X Mountain Lion v10.8.5 [1].

Exploitation

An attacker must have local access to the system and the ability to execute a crafted system call. No additional authentication or elevated privileges are required beyond standard user-level access. By invoking the vulnerable system call with specific parameters, the attacker triggers the unrestricted read operation, leaking kernel memory contents.

Impact

Successful exploitation results in the disclosure of sensitive information from kernel memory, including data that can be used to bypass Address Space Layout Randomization (ASLR). This information disclosure weakens the system's security defenses and can facilitate further attacks, such as privilege escalation or code execution.

Mitigation

Apple addressed this issue in OS X Mavericks 10.9.4, released on June 30, 2014. The update is available via Software Update or from the Apple Support website [1]. Users should apply the update to all affected systems. No workarounds are documented; updating to the fixed version is the only mitigation.