dyld in Apple OS X before 10.10.5 does not properly validate pathnames in the environment, which allows local users to gain privileges via unspecified vectors.
No PoCs from references.
- https://github.com/TH3-HUNT3R/Root-MacOS
- https://github.com/ruxzy1/rootOS
- https://github.com/thehappydinoa/rootOS