CVE-2015-3693

High

Published: 03/07/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Earlier versions of Apple Mac EFI before 2015-001, used in OS X before 10.10.4, do not properly set refresh rates for DDR3 RAM. This may make it easier for remote attackers to conduct row-hammer attacks, potentially leading to privilege escalation or denial of service (memory corruption).

Risk Assessment

The organization may be vulnerable to remote attacks that could lead to privilege escalation or system failure due to memory corruption.

Recommendation

It is recommended to update the system to the latest version to mitigate these vulnerabilities.

Other vulnerabilities in Apple Mac EFI

CVE-2015-7035High
Apple Mac EFI before version 2015-002, used in OS X before 10.11.1 and other products, mishandles arguments, allowing attackers to access 'unused' functions via unspecified vectors.

Original NVD description (English source)

Apple Mac EFI before 2015-001, as used in OS X before 10.10.4 and other products, does not properly set refresh rates for DDR3 RAM, which might make it easier for remote attackers to conduct row-hammer attacks, and consequently gain privileges or cause a denial of service (memory corruption), by triggering certain patterns of access to memory locations.