2026-05-15 02:56 UTC
Still diffing macOS 15.7.5 vs 15.7.7:
On 15.7.7, msgctl(IPC_SET), after getting the message queue and computing ipcperm, no longer drops its lock during the copyin:
https://github.com/apple-oss-distributions/xnu/blob/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/bsd/kern/sysv_msg.c#L492
So maybe this is the race condition of CVE-2026-28986?
Replies (1)
-
@zhuowei@notnow.dev 2026-05-15 03:33
More macOS 15.7.7 diffs: msgget, instead of doing /* Make sure that the returned msqid is unique */ msqptr->u.msg_perm._seq++; (seq is a short) Now does something fancier: (decompiled:) int uVar1 = msqptr->u.msg_perm._seq; msqptr->u.msg_perm._seq = uVar1 & ((short)uVar1 >> 0xf ^ 0xffffU); https://github.com/apple-oss-distributions/xnu/blob/5c306bec31e314fa4d8bbdafb2f6f5a6b7e7b291/bsd/kern/sysv_msg.c#L670