13-Year macOS Root Escalation Bug Detailed

Patrick Wardle details CVE-2017-7170, a long-lived macOS flaw letting local users sniff authorization tokens via a ramdisk trick to gain root.

This is a retrospective technical writeup by researcher Patrick Wardle explaining a local privilege-escalation vulnerability he discovered affecting the deprecated AuthorizationExecuteWithPrivileges API on macOS/OS X, present from Tiger (10.4) through 10.13. The flaw stemmed from how the API 'externalized' an AuthorizationRef and wrote it to a temporary file before passing it to the setuid security_authtrampoline helper process. Because a local unprivileged user could symlink their $TMPDIR to a self-created ramdisk, they could read the raw bytes of the externalized authorization token directly off the ramdisk, wait for the legitimate user to authenticate via the normal auth dialog, and then replay the now-authorized token to execute arbitrary commands as root.

Wardle reported the issue to Apple in 2017. Apple first applied a silent short-term mitigation (blocking symlinking of $TMPDIR via SIP's sunlnk flag) without crediting the researcher, and later shipped a full fix in macOS 10.13.1, changing the IPC mechanism from a temp file to a pipe and assigning CVE-2017-7170. The post is purely educational/historical in nature — the vulnerability has been patched for years and there is no indication of in-the-wild exploitation; it serves as a case study in macOS authorization internals and insecure IPC design in privileged installer helper processes.

Source reporting: https://objective-see.org/blog/blog_0x55.html