13-Year macOS Root Escalation Bug Detailed
Patrick Wardle details CVE-2017-7170, a long-lived macOS flaw letting local users sniff authorization tokens via a ramdisk trick to gain root.
This is a retrospective technical writeup by researcher Patrick Wardle explaining a local privilege-escalation vulnerability he discovered affecting the deprecated AuthorizationExecuteWithPrivileges API on macOS/OS X, present from Tiger (10.4) through 10.13. The flaw stemmed from how the API 'externalized' an AuthorizationRef and wrote it to a temporary file before passing it to the setuid security_authtrampoline helper process. Because a local unprivileged user could symlink their $TMPDIR to a self-created ramdisk, they could read the raw bytes of the externalized authorization token directly off the ramdisk, wait for the legitimate user to authenticate via the normal auth dialog, and then replay the now-authorized token to execute arbitrary commands as root.
Wardle reported the issue to Apple in 2017. Apple first applied a silent short-term mitigation (blocking symlinking of $TMPDIR via SIP's sunlnk flag) without crediting the researcher, and later shipped a full fix in macOS 10.13.1, changing the IPC mechanism from a temp file to a pipe and assigning CVE-2017-7170. The post is purely educational/historical in nature — the vulnerability has been patched for years and there is no indication of in-the-wild exploitation; it serves as a case study in macOS authorization internals and insecure IPC design in privileged installer helper processes.
Mentioned in this report
Detection guidance
Unprivileged Process Creating Ramdisk and Symlinking TMPDIR
Detects an unprivileged user process creating a ramdisk (hdiutil or diskutil) and then symlinking TMPDIR to it—a technique to intercept AuthorizationRef tokens written to temp files by privileged helpers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unprivileged Process Creating Ramdisk and Symlinking TMPDIR
description: Detects creation of a ramdisk followed by symlinking of $TMPDIR to that
ramdisk by an unprivileged process. This pattern is consistent with AuthorizationRef
token interception attacks on macOS prior to 10.13.1.
tags:
- attack.privilege-escalation
- attack.t1548
- attack.t1068
logsource:
category: process_creation
product: macos
detection:
selection_ramdisk:
Image|endswith:
- /hdiutil
- /diskutil
CommandLine|contains:
- -nomount
- ram
selection_tmpdir_symlink:
Image|endswith: /ln
CommandLine|contains: $TMPDIR
filter_root:
User: root
condition: (selection_ramdisk or selection_tmpdir_symlink) and not filter_root
falsepositives:
- Administrative scripts creating temporary ramdisks for legitimate caching or testing
- Development tools that intentionally manipulate TMPDIR for sandbox or isolation
testing
level: high
id: ff5b4841-8b7a-5d64-8cf2-ce85bb18d074
status: experimental
author: Vorant
Privileged Helper Reading from User-Controlled Temporary Directory
Detects security_authtrampoline or other setuid helper processes opening and reading files from TMPDIR, indicating potential exploitation of insecure IPC via temporary files for authorization token interception. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Privileged Helper Reading from User-Controlled Temporary Directory
description: Detects setuid helper processes (especially security_authtrampoline)
performing file read operations on paths under TMPDIR. This pattern is consistent
with authorization IPC mechanisms that write privileged tokens to world-accessible
temp locations.
tags:
- attack.privilege-escalation
- attack.t1548
- attack.t1068
logsource:
category: file_event
product: macos
detection:
selection:
Image|endswith:
- /security_authtrampoline
- /authorizationtrampoline
TargetFilename|contains:
- /var/folders/
- /tmp/
EventType: CreateOpen
filter_root_tmpdir:
User: root
TargetFilename|contains: /var/folders/0/
condition: selection and not filter_root_tmpdir
falsepositives:
- Legitimate authorization dialogs reading temporary credentials during normal authentication
flows on unpatched macOS versions
level: medium
id: 4cd60c03-e3f5-52e7-911b-b86bbd87f652
status: experimental
author: Vorant
1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x55.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free