CVE-2014-8835

Vulnerability

The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type. This allows an attacker to provide a crafted dictionary to sysmond, causing an XPC type confusion. Affected versions include OS X Mavericks v10.9.5 and OS X Yosemite v10.10 and v10.10.1 [1].

Exploitation

An attacker with local access to the system can craft a malicious dictionary intended for sysmond, exploiting the type confusion in xpc_data_get_bytes. No authentication is required beyond local user access. The attack sequence involves sending the crafted dictionary to sysmond, which triggers the type confusion and leads to code execution.

Impact

Successful exploitation allows arbitrary code execution in the context of the sysmond process, which runs with elevated privileges. This can lead to full compromise of the system, including unauthorized data access and control.

Mitigation

Apple addressed this vulnerability in OS X Yosemite v10.10.2 and Security Update 2015-001, released on January 27, 2015 [1]. Users should update to OS X 10.10.2 or later. No workaround is available; upgrading is the recommended mitigation.