CVE-2014-4489

Vulnerability

IOHIDFamily in Apple iOS before 8.1.3, OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, leading to a NULL pointer dereference. A crafted application can trigger the uninitialized pointer, causing memory corruption that leads to arbitrary code execution with kernel privileges or denial of service.

Exploitation

An attacker must convince a user to run a crafted application on the vulnerable system. No special network position or authentication beyond local execution is required. The exploit sends specific input events that lead to dereferencing a NULL pointer in the IOHIDFamily kernel extension.

Impact

Successful exploitation allows arbitrary code execution in kernel (privileged) context. This gives the attacker full control over the device, including ability to install software, modify system files, or access sensitive data. Alternatively, the bug may cause a denial of service via kernel panic.

Mitigation

For iOS, the fix was released in iOS 8.1.3 [2]; for OS X, in OS X Yosemite v10.10.2 and Security Update 2015-001 [1]; for Apple TV, in Apple TV 7.0.3 [3]. Users should update affected devices to these versions. No workaround is available for unpatched systems.