CVE-2014-4442

Vulnerability

The vulnerability resides in the kernel of Apple OS X versions prior to 10.10 (Yosemite). A local user can cause a denial of service (kernel panic) by sending a specially crafted message to a system control socket. The affected code path is reachable without any special privileges beyond local access to the system.

Exploitation

An attacker must have local access to the system and the ability to send messages to system control sockets. No authentication or user interaction beyond local login is required. The attacker crafts a malicious message and delivers it to a system control socket, triggering a kernel panic.

Impact

Successful exploitation results in a kernel panic, causing an immediate denial of service. The system becomes unresponsive and must be rebooted. No data corruption or privilege escalation is reported; the impact is limited to availability.

Mitigation

Apple addressed this issue in OS X Yosemite v10.10. Users should upgrade to OS X 10.10 or later to mitigate the vulnerability. No workarounds are documented for unpatched systems. The fix is confirmed in the Apple security content for OS X Yosemite v10.10 [1].