macOS kernel bug bypassed Gatekeeper checks

Researcher Patrick Wardle detailed CVE-2021-30853, a macOS kernel flaw letting unsigned, non-notarized apps bypass Gatekeeper, File Quarantine, and notarization.

This is a technical deep-dive from Objective-See analyzing CVE-2021-30853, a macOS kernel vulnerability discovered by Gordon Long and patched by Apple in macOS 12 beta 6 and 11.6. The bug allows a malicious, unsigned, non-notarized application—disguised as an innocuous file such as a resume—to fully bypass Gatekeeper, File Quarantine, and notarization checks with a single double-click, leading to arbitrary code execution without any user warning.

The root cause lies in how macOS handles 'interpreter-less' shell scripts (a script starting with a bare shebang #! with no interpreter specified). When such a script-based application is launched via xpcproxy, the initial posix_spawn call fails with ENOEXEC because the kernel's exec_shell_imgact image activator cannot identify an interpreter. Critically, fields in the kernel's image_params structure (ip_scriptvp, ip_scriptlabelp) used by the MACF security subsystem to label and evaluate the script are never populated in this failure path. Because posix_spawnp then retries execution directly via /bin/sh, the script runs — but the syspolicyd user-mode daemon (which normally invokes Gatekeeper/notarization checks) is never called, since the kernel never properly flagged the item for evaluation.

The author draws comparisons to a related but distinct bug, CVE-2021-30657 (discovered by Cedric Owens and detailed in an earlier Objective-See post), which achieved a similar Gatekeeper bypass through a flaw in the user-mode syspolicyd rather than the kernel. Both vulnerabilities highlight how macOS's layered security architecture (Gatekeeper, File Quarantine, notarization, XProtect) can be undermined by edge cases in application-launch handling, providing adware and malware authors a reliable technique to sidestep macOS's built-in defenses against untrusted internet-downloaded content.

Source reporting: https://objective-see.org/blog/blog_0x6A.html