CVE-2015-5900

Vulnerability

The protected range register in the EFI component of Apple OS X before version 10.11 contains an incorrect value. This allows a crafted application to write to an unintended memory address, leading to a denial of service condition. The issue affects all versions prior to OS X 10.11 El Capitan. [1]

Exploitation

An attacker must have the ability to run a crafted app on the target system. The app writes to an unintended address due to the misconfigured protected range register, causing the system to fail during boot. No additional privileges or user interaction beyond executing the app are required. [1]

Impact

Successful exploitation results in a denial of service, specifically a boot failure, preventing the system from starting. The attacker does not gain code execution or data access; the impact is limited to availability. [1]

Mitigation

The vulnerability is fixed in OS X El Capitan v10.11, released on September 30, 2015. Users should update to OS X 10.11 or later. No workarounds are documented. [1]