CVE-2014-1377

Vulnerability

An array index error exists in the IOAcceleratorFamily kernel extension in Apple OS X before version 10.9.4. This bug allows an attacker to trigger out-of-bounds memory access by crafting a malicious application. The affected versions include OS X Mavericks 10.9 through 10.9.3, as well as earlier OS X versions prior to 10.9.4 [1].

Exploitation

An attacker must deliver a crafted application to the target system and convince the user to run it. No additional privileges are required beyond normal user access. When the application is executed, it triggers the array index error within the IOAcceleratorFamily kernel extension, leading to a memory corruption condition that the attacker can leverage for further exploitation [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the kernel context. This results in complete compromise of the system, including full control over processes, data, and system resources. The attack does not require any special system configuration or user interaction beyond running the malicious application [1].

Mitigation

Apple addressed this vulnerability in OS X Mavericks 10.9.4, released on July 1, 2014. Users should update to the latest version via Software Update or from the Apple Support website. No workaround is available for unpatched systems [1].