Sniffing Authentication References on macOS

Patrick Wardle has published a detailed write-up of CVE-2017-7170, a macOS privilege-escalation flaw that Apple patched in 10.13.1. AuthorizationExecuteWithPrivileges wrote its externalized authorization token to a temp file. A local attacker could symlink $TMPDIR to a ramdisk, read the token, and reuse it once the user authenticated. Apple switched to passing the token through a pipe. For builders, the lesson is to keep credentials out of files, even unlinked ones.