CVE-2015-5784

Vulnerability

The vulnerability resides in the Install.framework component of Apple OS X, specifically in the runner binary located at /System/Library/PrivateFrameworks/Install.framework/Resources/runner. This binary is setuid root and exports the Distributed Object interface IFInstallRunner, which includes the method [IFInstallRunner makeReceiptDirAt:asRoot:]. When invoked with the asRoot parameter set to 1, the method attempts to create directories under a user-supplied path without proper privilege dropping. Affected versions include OS X Mavericks v10.9.5 and OS X Yosemite v10.10 through v10.10.4; it is fixed in OS X Yosemite v10.10.5 [1][2].

Exploitation

An attacker requires the ability to run a crafted app on the local system. The attacker can exploit the Distributed Objects IPC mechanism: instead of passing a plain NSString as the path argument, the attacker passes a custom object that behaves like a string but allows full control over method calls back in the attacker's process. By implementing specific selectors on this custom object, the attacker can trigger calls to mkdir, chown, and unlink with effective UID 0. The chown call sets the ownership to root:admin, and since regular OS X users typically belong to the admin group, this can grant the attacker write access to previously restricted files [2].

Impact

Successful exploitation allows an attacker to execute arbitrary code with root (euid 0) privileges. This includes creating arbitrary directories, changing file ownership (granting the attacker read-write access via the admin group), and deleting files. The ultimate outcome is full privilege escalation to root on the affected system [2].

Mitigation

Apple released the fix in OS X Yosemite v10.10.5 and Security Update 2015-006, available via the Apple Support page [1]. Users should update to the latest version. There is no known workaround; the vulnerable runner binary is a standard system component and cannot be safely removed. This CVE is not listed on the CISA KEV catalog as of the current date.