Detecting Race Conditions on macOS
summary
GCD misconfiguration causes real exploitable timing windows: a missing target queue on an XPC listener lets handlers run concurrently and led to GSSCred CVE (2018) enabling root memory corruption. Detection uses static checks for missing queue targeting, scans for dispatch_sync to serial queues, and runtime tooling like the Xcode Thread Performance Checker. Telemetry signals include repeated crash stacks around handler code, sustained thread churn and rapid thread creation, and queue backlog spikes; rate-limit or score parallel XPC bursts and correlate with crashes.
AI-written summary · about
chapters (14)
- 0:00Introduction and setup
- 1:56Processes threads and concurrency basics
- 4:41Grand Central Dispatch overview
- 7:08Priority inversion in macOS
- 10:18Testing for priority inversions
- 12:03Dispatch sync deadlocks explained
- 14:52Resource starvation via GCD
- 18:03GSS cred race condition case study
- 23:23XPC and sandbox escape risks
- 25:30Static review patterns for races
- 26:13Telemetry signals for concurrency bugs
- 28:19Detection engineering approach
- 29:21Summary and key takeaways
- 30:46Q&A session
related talks
31mRace Conditions - Practical Tools & Techniques for Testing, Preventing, and Debugging C++/C Code
35mRacing the Dark: A New TOCTTOU Story From Apple's Core
50mFinding Vulnerabilities In iOS/MacOS Networking Code
54mCatching Real-time Safety Violations in C++
34mExploiting Race Conditions Using the Scheduler
44mBreaking the Sound Barrier: Exploiting CoreAudio via Mach Message Fuzzing
29mStealing All macOS Sensitive Info with a Single Vulnerability
53mFuzzing At Mach Speed: Uncovering IPC Vulnerabilities On MacOS