Apple Core Rot : Debugging Severe Security Bug in Apple’s macOS Security Infrastructure (Apple Gatekeeper and Apple MRT)

2019-02-22 - SEND FEEDBACK

Related: Apple, Apple Core Rot, Apple Gatekeeper, Apple macOS, Apple MRT, iMac, security

As discussed two days ago in Apple Core Rot CAUTION: Apple’s macOS Security Infrastructure Might Not be Working on Your Mac, critical Apple security infrastructure fails to function properly leaving users protected with OUT OF DATE configuration (both Gatekeeper and MRT, perhaps years too old).

Today, Apple issued an update to MRT: MRTConfigData-1.40.

Apple’s system software fails to install this update, even after a reboot and even after reinstalling (over) macOS, as seen below. It looks like macOS is rife with bugs, including the security subsystem, as seen in system.log (more on that below).

Apple App Store preferences call for installing security updates but FAIL to do so, even after reboot and reinstall

Bugs in system.log

Look at the BUGS in the system.log itself! I am not making that up—the log itself calls out things as bugs. I don’t know what all of these mean or their significance, but failures in systemstats and heap corruption are VERY concerning.

malloc checsum failures in UpdaterStartupUtility sound awfully serious—memory is probably being corrupted.
“this may be a leak” (two areas)
undefined implementations to be used.
"BUG in libdispatch client" (multiple times)
Spotlight[638]: assertion failed
assertion failed: 17G5019: systemstats

Feb 22 10:13:54 diglloyd-iMac UpdaterStartupUtility[601]: UpdaterStartupUtility(601,0x7fff888af380) malloc: *** error for object 0x7fa77be00918: incorrect checksum for freed object - object was probably modified after being freed.
*** set a breakpoint in malloc_error_break to debug
Feb 22 10:13:54 diglloyd-iMac systemstats[71]: assertion failed: 17G5019: systemstats + 914800 [D1E75C38-62CE-3D77-9ED3-5F6D38EF0676]: 0x40
Feb 22 10:13:54 diglloyd-iMac cloudd[491]: notify name "com.apple.security.view-change.PCS" has been registered 20 times - this may be a leak
Feb 22 10:13:54 diglloyd-iMac cloudd[491]: notify name "com.apple.ProtectedCloudStorage.HaveCredentials" has been registered 20 times - this may be a leak
Feb 22 10:13:55 diglloyd-iMac com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent): Unknown key for integer: _DirtyJetsamMemoryLimit
Feb 22 10:13:55 diglloyd-iMac com.apple.AmbientDisplayAgent[470]: BUG in libdispatch client: dispatch_mig_server: mach_msg() failed (ipc/send) msg too small - 0x10000008
Feb 22 10:13:56 diglloyd-iMac com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent): Unknown key for integer: _DirtyJetsamMemoryLimit
Feb 22 10:13:56 diglloyd-iMac findmydeviced[645]: objc[645]: Class LocalizedUnregisterErrorKey is implemented in both /System/Library/PrivateFrameworks/FindMyDevice.framework/Versions/A/FindMyDevice (0x7fff8539c0a8) and /usr/libexec/findmydeviced (0x108abd668). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac suhelperd[704]: objc[704]: Class SUDevKey is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate (0x7fff877bce70) and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd (0x10ba71370). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac suhelperd[704]: objc[704]: Class SUReachabilityMonitor is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate (0x7fff877bd168) and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd (0x10ba713c0). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac suhelperd[704]: objc[704]: Class SUPrinterScan is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate (0x7fff877bdd70) and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd (0x10ba71488). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac suhelperd[704]: objc[704]: Class SUSharedPrefs is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate (0x7fff877bd230) and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd (0x10ba714b0). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac suhelperd[704]: objc[704]: Class SUPublicKey is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate (0x7fff877bdc80) and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd (0x10ba71528). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac suhelperd[704]: objc[704]: Class SUSignedFlatPkg is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate (0x7fff877bdc30) and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd (0x10ba71578). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac suhelperd[704]: objc[704]: Class SUPowerAssertionManager is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate (0x7fff877bd078) and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd (0x10ba715a0). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac suhelperd[704]: objc[704]: Class SUPowerSourceMonitor is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate (0x7fff877bd0a0) and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd (0x10ba715f0). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac suhelperd[704]: objc[704]: Class SUURLConnection is implemented in both /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Versions/A/SoftwareUpdate (0x7fff877bd2f8) and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd (0x10ba71640). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac suhelperd[704]: objc[704]: Class KeychainMasterHandler is implemented in both /usr/lib/libIASAuthReboot.dylib (0x7fff88165138) and /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd (0x10ba716e0). One of the two will be used. Which one is undefined.
Feb 22 10:14:02 diglloyd-iMac spindump_agent[569]: BUG in libdispatch client: dispatch_mig_server: mach_msg() failed (ipc/send) msg too small - 0x10000008
Feb 22 10:14:03 diglloyd-iMac parsecd[647]: libcoreservices: _dirhelper: 666: mkdir: path=/var/folders/hy/xl6wd2_17693t34d_t26vgl00000gn/0/com.apple.parsecd/ modes[0]=0755: Operation not permitted
Feb 22 10:14:04 diglloyd-iMac pbs[663]: BUG in libdispatch client: kevent[mach_recv] monitored resource vanished before the source cancel handler was invoked
Feb 22 10:14:04 diglloyd-iMac Spotlight[638]: assertion failed: 17G5019: libxpc.dylib + 75013 [903AB944-964B-3E73-89AE-A55F5424BD9A]: 0x89
Feb 22 10:14:05 diglloyd-iMac diagnosticd[740]: no EOS device present
Feb 22 10:14:05 diglloyd-iMac diagnosticd[740]: System mode client started - Console (730) - mode: 0xb
Feb 22 10:14:10 diglloyd-iMac parsecd[647]: BUG in libdispatch client: dispatch_mig_server: mach_msg() failed (ipc/send) invalid data - 0x10000002
Feb 22 10:14:10 diglloyd-iMac com.apple.xpc.launchd[1] (com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d[583]): Service exited with abnormal code: 111
Feb 22 10:14:14 diglloyd-iMac com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent): Unknown key for integer: _DirtyJetsamMemoryLimit
Feb 22 10:14:17 --- last message repeated 1 time ---
Feb 22 10:14:17 diglloyd-iMac com.apple.xpc.launchd[1] (com.apple.quicklook.satellite.F36CC4CD-0F57-495F-B594-D710B321CFB7[670]): Service exited due to signal: Killed: 9 sent by launchd[1]
Feb 22 10:14:17 diglloyd-iMac com.apple.xpc.launchd[1] (com.apple.AddressBook.abd): Service only ran for 5 seconds. Pushing respawn out by 5 seconds.
Feb 22 10:14:17 diglloyd-iMac com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent): Unknown key for integer: _DirtyJetsamMemoryLimit
Feb 22 10:14:18 diglloyd-iMac Dock[603]: BUG in libdispatch client: kevent[mach_recv] monitored resource vanished before the source cancel handler was invoked
Feb 22 10:14:23 diglloyd-iMac com.apple.xpc.launchd[1] (com.apple.imfoundation.IMRemoteURLConnectionAgent): Unknown key for integer: _DirtyJetsamMemoryLimit
Feb 22 10:14:27 diglloyd-iMac systemstats[71]: assertion failed: 17G5019: systemstats + 914800 [D1E75C38-62CE-3D77-9ED3-5F6D38EF0676]: 0x40
Feb 22 10:14:46 diglloyd-iMac CalendarAgent[507]: BUG in libdispatch client: dispatch_mig_server: mach_msg() failed (ipc/send) invalid data - 0x10000002