A bug in the latest version of Apple's OS X gives attackers the ability to obtain unfettered root user privileges, a feat that makes it easier to surreptitiously infect Macs with rootkits and other types of persistent malware.

The privilege-escalation bug, which was reported in a blog post published Tuesday by security researcher Stefan Esser, is the type of security hole attackers regularly exploit to bypass security protections built into modern operating systems and applications. Hacking Team, the Italian malware-as-a-service provider that catered to governments around the world, recently exploited similar elevation-of-privileges bugs in Microsoft Windows. When combined with a zero-day exploit targeting Adobe's Flash media player, Hacking Team was able to pierce security protections built into Google Chrome, widely regarded as the Internet's most secure browser by default.

According to Esser, the OS X privilege-escalation flaw stems from new error-logging features that Apple added to OS X 10.10. Developers didn't use standard safeguards involving additions to the OS X dynamic linker dyld, a failure that allows attackers to open or create files with root privileges that can reside anywhere in the OS X file system.

"This is obviously a problem, because it allows the creation or opening (for writing) of any file in the filesystem," Esser wrote. "And because the log file is never closed by dyld and the file is not opened with the close on exec flag the opened file descriptor is inherited by child processes of SUID binaries. This can be easily exploited for privilege escalation."

Esser said the vulnerability is present in both the current 10.10.4 (Yosemite) version of OS X and the current beta version of 10.10.5. Importantly, the current beta version of 10.11 is free of the flaw, an indication that Apple developers may already be aware of the vulnerability. It wouldn't be surprising for the fix to find its way into an incremental update to OS X released in the coming weeks. An Apple spokesman said that engineers are aware of Esser's post.

The proof-of-concept attack Esser included with his post is known as a local exploit. The typical scenario where these types of vulnerabilities are exploited is by developers of malicious applications who want to elevate privileges without prompting end users to enter a system password or by developers of remote exploits that on their own can execute malicious code as a regular user but not as root.

"Local exploits are considered less dangerous than remote exploits," well-known OS X security researcher Pedro Vilaca told Ars. "Still, they can be extremely useful in many scenarios. Local exploits in OS X are by the dozen. It seems everyone has a few."