In plain words
Think of your computer like a house where you keep your private things. Normally, only you can get into your house, but this flaw was like a hidden key that could let someone else get in and do things they should not be able to do. It is similar to finding a master key that can open many doors.
What's broken
The specific bug, known as CVE-2017-7170¹, was a local privilege escalation² vulnerability. This means it allowed an attacker who already had some access to the computer to gain more control than they should have. An attacker could potentially use this to get full control of the system.
How it actually works
The core flaw was in how macOS handled certain authentication references³. Essentially, it was possible for an attacker to sniff these references, which are like special tokens that say who you are and what you can do, and then use them to escalate their privileges⁴. This worked because of a flaw in how these tokens were protected and managed by the system. It is somewhat like intercepting a mail meant for someone else and then using the information in it to pretend to be them.
Terms
- ¹ CVE-2017-7170
- , A unique identifier for a security vulnerability
- ² local privilege escalation
- , A type of security vulnerability that allows an attacker to gain more privileges or access than they should have
- ³ authentication references
- , Information used to verify the identity of a user or process
- ⁴ escalate their privileges
- , The process of gaining more access or control than one should have