CVE-2014-8822

Vulnerability

IOHIDFamily, the kernel extension for Human Interface Devices in Apple OS X, contains a vulnerability in an unspecified user-client method. This issue affects OS X Yosemite versions before 10.10.2. The vulnerability is triggered when a crafted application calls the vulnerable user-client method, leading to a write to kernel memory.

Exploitation

An attacker must have local access to the system and the ability to run a crafted application. The application calls the unspecified user-client method in IOHIDFamily, which results in a write to kernel memory. No additional authentication or privileges are required beyond the ability to execute the app.

Impact

Successful exploitation allows an attacker to execute arbitrary code in kernel context or cause a denial of service by writing to kernel memory. This gives the attacker full control over the system or the ability to crash it.

Mitigation

Apple addressed this vulnerability in OS X Yosemite v10.10.2 and Security Update 2015-001, released on January 27, 2015 [1]. Users should update to the latest version. No workarounds are documented.