# macOS APFS Password Hint Bug Dissected

The source gives no date; added 2026-10-13 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/0d0163ba-cd3a-54e4-9991-78f78e34577b/macos-apfs-password-hint-bug-dissected

> Objective-See reverse-engineers CVE-2017-7149, a patched macOS High Sierra flaw that stored APFS volume passwords in plaintext password hints.

This Objective-See blog post walks through a reverse-engineering exercise to independently rediscover the root cause of CVE-2017-7149, a vulnerability in macOS High Sierra (10.13) that was originally discovered by Matheus Mariano and later diffed by Daniel Martín. The bug caused the plaintext password used to encrypt an APFS volume to be stored and displayed as the 'password hint' instead of the actual hint text entered by the user. Any local user or attacker with access to the 'Show Hint' UI during a volume unlock prompt could recover the full encryption password, completely undermining APFS volume encryption.

The author traces the bug from the Disk Utility.app UI layer down through SUSharedActionController and SUAddAPFSVolumeSheetController classes, into the private StorageKit framework's SKAPFSContainerDisk and SKHelperClient classes, and finally into the addChildVolumeToAPFSContainer method where a copy-paste error caused the password variable to be used twice — once correctly for kSKAPFSDiskPasswordOption and erroneously again for kSKAPFSDiskPasswordHintOption — rather than using the actual password hint variable. This dictionary was then passed via XPC to the storagekitd daemon, which persisted the incorrect hint value.

Apple patched this issue in a supplemental security update for High Sierra prior to this blog's publication (the vulnerability is not a zero-day at time of writing). The post is a methodology/educational writeup demonstrating UI-level reverse engineering techniques (lldb, class-dump, breakpoints) as an alternative to patch diffing. Defenders running macOS should ensure the supplemental High Sierra security update is applied; no exploitation in the wild is reported, and the issue is historical/already remediated.

## Mentioned in this report

- Vulnerabilities: CVE-2017-7149

Source reporting: https://objective-see.org/blog/blog_0x23.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0d0163ba-cd3a-54e4-9991-78f78e34577b/macos-apfs-password-hint-bug-dissected.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup