CVE-2015-3768

Vulnerability

An integer overflow vulnerability exists in the kernel of Apple iOS before 8.4.1 and OS X before 10.10.5. The issue occurs when a crafted application makes unspecified IOKit API calls, leading to memory corruption. Affected versions include iOS 8.4 and earlier, and OS X Yosemite 10.10.4 and earlier [1][2].

Exploitation

An attacker must convince a user to install a crafted application on the target device. No additional authentication or network access is required beyond the initial app installation. The app triggers the integer overflow by making specific IOKit calls, causing memory corruption that can be leveraged for code execution.

Impact

Successful exploitation allows the attacker to execute arbitrary code in a privileged kernel context, resulting in full compromise of the device's system integrity, confidentiality, and availability.

Mitigation

Apple addressed this vulnerability in iOS 8.4.1 and OS X Yosemite 10.10.5. Users should update their devices to these or later versions. No workarounds are available; the only mitigation is to apply the security updates [1][2].