CVE-2014-1381

Vulnerability

The vulnerability exists in the Thunderbolt driver (IOThunderBoltController) in Apple OS X versions prior to 10.9.4. The driver does not properly restrict API calls, allowing out-of-bounds memory access. This affects OS X Mavericks 10.9 to 10.9.3, and possibly earlier versions like Mountain Lion and Lion as per the security update [1].

Exploitation

An attacker can exploit this by crafting a malicious call to the IOThunderBoltController API. The attacker needs local access to the system to execute the crafted call, as the Thunderbolt driver is a kernel extension. No user interaction is required beyond the attacker having the ability to execute code locally.

Impact

Successful exploitation can lead to arbitrary code execution in the kernel context, or a denial of service via application crash due to out-of-bounds memory access. The attacker gains elevated privileges, potentially full control of the system.

Mitigation

Apple addressed this vulnerability in OS X Mavericks 10.9.4, released on June 30, 2014. Users should update to 10.9.4 or later via Software Update or from Apple Support [1]. No workarounds are documented.