Advisory Details

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Apple OS X. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within AppleIntelFramebufferAzul. The issue lies with the failure to validate user-supplied arguments which can cause a null pointer dereference. An attacker can leverage this vulnerability to escalate privileges and execute code under the context of the kernel.

• 2016-08-25 - Vulnerability reported to vendor
• 2016-12-15 - Coordinated public release of advisory