CVE-2014-8817

Vulnerability

coresymbolicationd in CoreSymbolication on Apple OS X prior to 10.10.2 does not validate that XPC messages contain the expected data types. The service fails to check return values from xpc_dictionary_get_value API calls when processing match_mmap_archives, delete_mmap_archives, write_mmap_archive, or read_mmap_archive commands. This allows a maliciously crafted application to send XPC messages with unexpected data types, leading to memory corruption.

Exploitation

An attacker must run a crafted application on the target system. The application sends specially crafted XPC messages to coresymbolicationd that do not conform to the expected data types. Because the service does not verify the return values of xpc_dictionary_get_value, it may operate on invalid data, resulting in a memory corruption vulnerability that can be leveraged for arbitrary code execution.

Impact

Successful exploitation enables arbitrary code execution in a privileged context (likely root). The attacker gains full system control, allowing installation of malware, modification of system files, and access to sensitive data. The compromise is complete, affecting confidentiality, integrity, and availability.

Mitigation

Apple addressed this vulnerability in OS X Yosemite v10.10.2 and Security Update 2015-001 [1]. Users should update to OS X v10.10.2 or later. No workarounds are documented. This CVE is not listed on the CISA Known Exploited Vulnerabilities catalog.