macOS kernel bug bypassed Gatekeeper checks
Researcher Patrick Wardle detailed CVE-2021-30853, a macOS kernel flaw letting unsigned, non-notarized apps bypass Gatekeeper, File Quarantine, and notarization.
This is a technical deep-dive from Objective-See analyzing CVE-2021-30853, a macOS kernel vulnerability discovered by Gordon Long and patched by Apple in macOS 12 beta 6 and 11.6. The bug allows a malicious, unsigned, non-notarized application—disguised as an innocuous file such as a resume—to fully bypass Gatekeeper, File Quarantine, and notarization checks with a single double-click, leading to arbitrary code execution without any user warning.
The root cause lies in how macOS handles 'interpreter-less' shell scripts (a script starting with a bare shebang #! with no interpreter specified). When such a script-based application is launched via xpcproxy, the initial posix_spawn call fails with ENOEXEC because the kernel's exec_shell_imgact image activator cannot identify an interpreter. Critically, fields in the kernel's image_params structure (ip_scriptvp, ip_scriptlabelp) used by the MACF security subsystem to label and evaluate the script are never populated in this failure path. Because posix_spawnp then retries execution directly via /bin/sh, the script runs — but the syspolicyd user-mode daemon (which normally invokes Gatekeeper/notarization checks) is never called, since the kernel never properly flagged the item for evaluation.
The author draws comparisons to a related but distinct bug, CVE-2021-30657 (discovered by Cedric Owens and detailed in an earlier Objective-See post), which achieved a similar Gatekeeper bypass through a flaw in the user-mode syspolicyd rather than the kernel. Both vulnerabilities highlight how macOS's layered security architecture (Gatekeeper, File Quarantine, notarization, XProtect) can be undermined by edge cases in application-launch handling, providing adware and malware authors a reliable technique to sidestep macOS's built-in defenses against untrusted internet-downloaded content.
Mentioned in this report
Detection guidance
Execution of Unsigned Script via Shell Interpreter Fallback
Detection of unsigned scripts being executed through shell interpreter fallback (sh/bash) after initial posix_spawn failure, bypassing Gatekeeper validation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Execution of Unsigned Script via Shell Interpreter Fallback
description: Detects execution of unsigned or non-notarized scripts that bypass Gatekeeper
through kernel-level posix_spawn failures followed by direct shell interpreter invocation.
The pattern matches scripts launched via xpcproxy or similar mechanisms where Gatekeeper
checks are skipped due to malformed shebang or missing interpreter specification.
tags:
- attack.defense-evasion
- attack.t1553.001
- attack.t1204.002
logsource:
category: process_creation
product: macos
detection:
selection_shell_execution:
Image|endswith:
- /bin/sh
- /bin/bash
CommandLine|contains:
- '#!'
selection_unsigned_indicator:
ParentImage|endswith:
- /usr/libexec/xpcproxy
- /usr/libexec/launchd
SignatureStatus: unsigned
filter_legitimate_scripts:
CommandLine|contains:
- /usr/local/bin/
- /opt/homebrew/bin/
condition: (selection_shell_execution and selection_unsigned_indicator) and not
filter_legitimate_scripts
falsepositives:
- Legitimate developer scripts executed from build systems or package managers
- System maintenance scripts with dynamic shebangs
level: high
id: 429f4a28-578b-528c-897a-83cd62eeb82c
status: experimental
author: Vorant
Absence of Gatekeeper Evaluation for Script-Based Application Launch
Detection of application execution where syspolicyd was not invoked during launch, indicating potential Gatekeeper/notarization check bypass. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Absence of Gatekeeper Evaluation for Script-Based Application Launch
description: Detects execution of applications that should trigger Gatekeeper/notarization
evaluation but for which syspolicyd was never invoked. This is characteristic of
the CVE-2021-30853 exploit where kernel-level failures in exec_shell_imgact prevent
proper security labeling and syspolicyd invocation.
tags:
- attack.defense-evasion
- attack.t1553.001
logsource:
category: process_creation
product: macos
detection:
selection_suspicious_launch:
ParentImage|endswith:
- /usr/libexec/xpcproxy
- /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/LaunchServices.framework/Versions/A/Support/lsd
Image|endswith:
- /bin/sh
- /bin/bash
selection_internet_origin:
Quarantine|contains:
- LSQuarantine
- Downloaded
filter_system_processes:
Image|startswith:
- /System/
- /Library/
- /usr/libexec/
condition: (selection_suspicious_launch and selection_internet_origin) and not filter_system_processes
falsepositives:
- Legitimate shell script wrappers installed via package managers
- User-created automation scripts downloaded from trusted sources
level: medium
id: 322479b2-d52f-5068-a2ea-a81e64ef6c82
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x6A.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free