13-Year macOS Root Escalation Bug Detailed

PublishedThe source gives no date · added 2 August 2026 Vorant ratingroutine vulnerability

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Patrick Wardle details CVE-2017-7170, a long-lived macOS flaw letting local users sniff authorization tokens via a ramdisk trick to gain root.

Sourceobjective-see.org — open the original

What to check

Applies to: The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
Exploitation: No exploitation in the wild and no public exploit is recorded for the CVEs named.
Date: The source gives no publication date; the date shown is the day Vorant added the brief.

This is a retrospective technical writeup by researcher Patrick Wardle explaining a local privilege-escalation vulnerability he discovered affecting the deprecated AuthorizationExecuteWithPrivileges API on macOS/OS X, present from Tiger (10.4) through 10.13. The flaw stemmed from how the API 'externalized' an AuthorizationRef and wrote it to a temporary file before passing it to the setuid security_authtrampoline helper process. Because a local unprivileged user could symlink their $TMPDIR to a self-created ramdisk, they could read the raw bytes of the externalized authorization token directly off the ramdisk, wait for the legitimate user to authenticate via the normal auth dialog, and then replay the now-authorized token to execute arbitrary commands as root.

Wardle reported the issue to Apple in 2017. Apple first applied a silent short-term mitigation (blocking symlinking of $TMPDIR via SIP's sunlnk flag) without crediting the researcher, and later shipped a full fix in macOS 10.13.1, changing the IPC mechanism from a temp file to a pipe and assigning CVE-2017-7170. The post is purely educational/historical in nature — the vulnerability has been patched for years and there is no indication of in-the-wild exploitation; it serves as a case study in macOS authorization internals and insecure IPC design in privileged installer helper processes.

Mentioned in this report

Vulnerabilities CVE-2017-7170

Detection guidance

Unprivileged Process Creating Ramdisk and Symlinking TMPDIR

ATT&CK T1548 · status experimental · needs macos process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general, not a signature for the CVEs this report names.

Detects an unprivileged user process creating a ramdisk (hdiutil or diskutil) and then symlinking TMPDIR to it—a technique to intercept AuthorizationRef tokens written to temp files by privileged helpers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unprivileged Process Creating Ramdisk and Symlinking TMPDIR
description: Detects creation of a ramdisk followed by symlinking of $TMPDIR to that
  ramdisk by an unprivileged process. This pattern is consistent with AuthorizationRef
  token interception attacks on macOS prior to 10.13.1.
tags:
- attack.privilege-escalation
- attack.t1548
- attack.t1068
logsource:
  category: process_creation
  product: macos
detection:
  selection_ramdisk:
    Image|endswith:
    - /hdiutil
    - /diskutil
    CommandLine|contains:
    - -nomount
    - ram
  selection_tmpdir_symlink:
    Image|endswith: /ln
    CommandLine|contains: $TMPDIR
  filter_root:
    User: root
  condition: (selection_ramdisk or selection_tmpdir_symlink) and not filter_root
falsepositives:
- Administrative scripts creating temporary ramdisks for legitimate caching or testing
- Development tools that intentionally manipulate TMPDIR for sandbox or isolation
  testing
level: high
id: ff5b4841-8b7a-5d64-8cf2-ce85bb18d074
status: experimental
author: Vorant

1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x55.html

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs