CVE-2015-3693

Vulnerability

Apple Mac EFI firmware before version 2015-001, as used in OS X before 10.10.4 and other products, does not properly set refresh rates for DDR3 RAM [3]. This makes the system more susceptible to row-hammer attacks, where repeated memory accesses to DRAM rows can cause bit flips in adjacent rows.

Exploitation

An attacker can exploit this by triggering specific memory access patterns to induce disturbance errors. While remote exploitation may be limited, local unprivileged processes can gain kernel privileges by inducing bit flips in page table entries, as demonstrated on Linux [1]. On vulnerable Apple systems, similar techniques could be used.

Impact

Successful exploitation allows an attacker to gain elevated privileges, potentially leading to arbitrary code execution with kernel-level access, or cause a denial of service through memory corruption.

Mitigation

Apple released Mac EFI Security Update 2015-001 and OS X Yosemite v10.10.4 to address this issue [2][3]. Users should apply these updates. No workaround is available.