macOS kernel bug bypassed Gatekeeper checks
Researcher Patrick Wardle detailed CVE-2021-30853, a macOS kernel flaw letting unsigned, non-notarized apps bypass Gatekeeper, File Quarantine, and notarization.
Sourceobjective-see.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2021-30657 as exploited in the wild.
This is a technical deep-dive from Objective-See analyzing CVE-2021-30853, a macOS kernel vulnerability discovered by Gordon Long and patched by Apple in macOS 12 beta 6 and 11.6. The bug allows a malicious, unsigned, non-notarized application—disguised as an innocuous file such as a resume—to fully bypass Gatekeeper, File Quarantine, and notarization checks with a single double-click, leading to arbitrary code execution without any user warning.
The root cause lies in how macOS handles 'interpreter-less' shell scripts (a script starting with a bare shebang #! with no interpreter specified). When such a script-based application is launched via xpcproxy, the initial posix_spawn call fails with ENOEXEC because the kernel's exec_shell_imgact image activator cannot identify an interpreter. Critically, fields in the kernel's image_params structure (ip_scriptvp, ip_scriptlabelp) used by the MACF security subsystem to label and evaluate the script are never populated in this failure path. Because posix_spawnp then retries execution directly via /bin/sh, the script runs — but the syspolicyd user-mode daemon (which normally invokes Gatekeeper/notarization checks) is never called, since the kernel never properly flagged the item for evaluation.
The author draws comparisons to a related but distinct bug, CVE-2021-30657 (discovered by Cedric Owens and detailed in an earlier Objective-See post), which achieved a similar Gatekeeper bypass through a flaw in the user-mode syspolicyd rather than the kernel. Both vulnerabilities highlight how macOS's layered security architecture (Gatekeeper, File Quarantine, notarization, XProtect) can be undermined by edge cases in application-launch handling, providing adware and malware authors a reliable technique to sidestep macOS's built-in defenses against untrusted internet-downloaded content.
Mentioned in this report
Source reporting: https://objective-see.org/blog/blog_0x6A.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs