Following Apple’s last-week distribution of patches, Microsoft has made public its research of the Achilles macOS Gatekeeper flaw it found in July.
The Monterey, Big Sur, and Ventura versions of macOS contain the CVE-2022-42821 flaw, which makes it possible for apps to avoid Gatekeeper tests.
When users download apps from the Internet, Gatekeeper verifies them. The user is prompted to affirm their want to run an app if it is signed by Apple; otherwise, the software is deemed untrusted and execution is denied.
Jonathan Bar Or, a security researcher for Microsoft, found that an attacker may get around Gatekeeper by using the access control lists (ACLs) in macOS.
ACLs provide for finer-grained access management for files and directories than is possible with the permission paradigm that Mac OS received from its Unix ancestors.
Bar Or found a flaw in the way ACLs are applied to files. It stops downloaders and browsers from establishing the com.apple.quarantine attribute, which informs Gatekeeper that a file is suspect.
