CVE-2014-1376

Vulnerability

In Apple OS X versions before 10.9.4, the Intel Compute subsystem does not properly restrict an unspecified OpenCL API call. The vulnerability affects OS X Mavericks 10.9 to 10.9.3, as well as OS X Lion v10.7.5, OS X Lion Server v10.7.5, and OS X Mountain Lion v10.8.5. The exact API call is not disclosed in the available references [1].

Exploitation

An attacker must trick a user into running a crafted application on an affected system. The attacker requires no special network position or authentication beyond the ability to execute code at the user level. The specific steps are not detailed, but the vector is a malicious application that makes the vulnerable OpenCL API call [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the target system. The attacker gains code execution privileges, potentially leading to full system compromise. The impact includes arbitrary code execution, which may result in information disclosure, data modification, or denial of service [1].

Mitigation

Apple released OS X Mavericks v10.9.4 on July 1, 2014, which includes a fix for this issue. Users should update to OS X Mavericks 10.9.4 or later via Software Update or the Apple Support website. For earlier affected versions (OS X Lion v10.7.5, OS X Mountain Lion v10.8.5), the Security Update 2014-003 provides the fix. No workaround is disclosed [1].