Why _blank_ Gets You Root

Patrick Wardle's reverse-engineering of the November 2017 macOS High Sierra "root with a blank password" flaw (CVE-2017-13872) traces it to opendirectoryd's PlistFile module. For a disabled account like root, the code calls od_verify_crypt_password but checks only its return value, not the "match" variable holding the verification result. It then saves the attacker's password for the account. Apple's patch adds that check, though the author reports it broke file sharing and was undone by upgrading to 10.13.1. Several details were not independently verified.