CVE-2017-13907

Vulnerability

A state management issue in the screen lock functionality of macOS High Sierra 10.13 (and earlier) may cause the screen lock to unexpectedly remain unlocked after the system is locked. This affects macOS High Sierra before 10.13.1, macOS Sierra before Security Update 2017-001, and OS X El Capitan before Security Update 2017-004 [1].

Exploitation

An attacker with physical access to a system that has not been updated could encounter an unlocked screen after the intended lock would have activated. No user interaction or authentication is required; the vulnerability manifests due to improper state validation during the lock process.

Impact

Successful exploitation allows an attacker to gain unauthorized physical access to the system, potentially viewing or modifying data without needing to bypass the lock screen. This compromises confidentiality and integrity of user data.

Mitigation

The issue is resolved in macOS High Sierra 10.13.1, Security Update 2017-001 for Sierra, and Security Update 2017-004 for El Capitan [1]. Users should update to the latest available versions.