CVE-2017-13887
📋 TL;DR
This macOS vulnerability allows attackers to bypass authentication and gain root access to systems without a password. It affects macOS High Sierra systems before version 10.13.2. The flaw exists in APFS file system logic during hibernation state management.
💻 Affected Systems
- macOS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root access, allowing installation of persistent malware, data theft, and full control of the affected system.
Likely Case
Local privilege escalation allowing attackers with physical or remote desktop access to bypass authentication and gain administrative privileges.
If Mitigated
Limited impact if systems are fully patched, use strong authentication controls, and restrict physical access to sensitive systems.
🎯 Exploit Status
Simple exploit requiring physical access or remote desktop control. Demonstrated publicly with easy-to-follow steps.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: macOS High Sierra 10.13.2 or later
Vendor Advisory: https://support.apple.com/HT208331
Restart Required: Yes
Instructions:
1. Open System Preferences 2. Click Software Update 3. Install macOS High Sierra 10.13.2 or later update 4. Restart the system when prompted
🔧 Temporary Workarounds
Enable FileVault
macosFull disk encryption adds additional authentication layer that may prevent exploitation
sudo fdesetup enable
Disable Automatic Login
macosPrevents automatic bypass of login screen
sudo defaults write /Library/Preferences/.GlobalPreferences com.apple.userspref.DisableAutoLogin -bool YES
🧯 If You Can't Patch
- Restrict physical access to vulnerable systems
- Disable remote desktop/SSH access to vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Check macOS version: if running High Sierra and version is less than 10.13.2, system is vulnerableCheck Version:
sw_versVerify Fix Applied:
Verify macOS version is 10.13.2 or later and attempt authentication bypass using known exploit methods📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts followed by successful root access
- Unexpected authentication events in system.log
Network Indicators:
- Unusual remote desktop connections to vulnerable systems
SIEM Query:
source="system.log" AND ("root" OR "authentication") AND "failed" AND "successful"