Re: Critical infrastructure update failing in TLU alone

> On 18 Aug 2026, at 20:19, Bruno Voisin <[email protected]> wrote:
> 
> Wait: if I interpret <https://github.com/Lyutoon/macOS_DSH_LPE> correctly, a vulnerability using AuthorizationExecuteWithPrivileges has been disclosed very recently (2026-07-18), and "Apple confirmed the underlying bug had already been fixed in a macOS 26.6 beta from mid-June 2026". So maybe the latest betas of macOS 27 include the same security fix, and that's what's disrupting TLU.

This is all very cryptic. My impression is the associated security fix is

DesktopServices
Available for: macOS Tahoe
Impact: An app may bypass Gatekeeper checks
Description: A file quarantine bypass was addressed with additional checks.
CVE-2026-64708: Lance Cain - Offensive Security Engineer, SpecterOps Inc.

in the list <https://support.apple.com/en-us/128067> of macOS 26.6 Tahoe security fixes (from July 27).

If that interpretation is correct, the same TLU problem would arise not only on macOS 27 Beta, but also on macOS 26.6. Herb's and Tom's messages give the impression this is not the case.

I'm lost. Does macOS object to the way PATH is constructed by TLU? (The LPE mentions "caller-supplied paths with no path-containment check and no entitlement gate" -- I had no idea such things existed.) Is this a matter of not using AuthorizationExecuteWithPrivileges()? Of adding an entitlement such as com.apple.developer.security.privileged-file-operations?

Just to be sure, I checked whether update-tlmgr-latest.sh has the com.apple.quarantine extended attribute in the location, like /var/folders/jk/khszwygs023gr2sdrkk02w100000gn/T/TLMInfraUpdateOperation.x0JbJY/, where TLU stores it temporarily: no such attribute, update-tlmgr-latest.sh isn't quarantined.

I'll stop there, as this is clearly out of my league.

Bruno