Two More Ways the Quarantine Attribute Can Fail Us

The talk looks at two Gatekeeper bypasses in macOS, CVE-2021-1810 and CVE-2023-27943, both uncovered while the presenters built their own endpoint protection product. Gatekeeper only runs its checks on files carrying the quarantine attribute, which the system normally sets when a browser downloads a file. The first case involved a Chrome download that arrived without that attribute. Tracing it through the launch services code led to a flag passed to a kernel call: vulnerable builds sent zero where patched builds sent one, and overriding the value in a debugger confirmed the fix.

The second bug surfaced from a customer complaint about long file paths inside archives. Archive Utility skipped quarantine for files nested at a particular path length, because its extraction code asked the traversal API to keep absolute paths and skip changing directories, and the staging location pushed those paths past the system limit. A crafted archive, paired with Safari's refusal to unpack it, pushed users toward Archive Utility in a demonstration. Apple moved quarantine handling into a separate helper process that works with relative paths.

For practitioners, the takeaways are that quarantine-based protections can fail in edge cases, that low-level path handling is easy to get wrong, and that testing software against common tools on the platform can surface such issues early. The speakers left open questions about a kernel change between Monterey and Ventura and about reliable kernel debugging, and suggested that path-length boundaries deserve more research.