DER Entitlements: The (Brief) Return of the Psychic Paper

Summary: Google Project Zero's Ivan Fratric describes CVE-2022-42855, a flaw in how Apple operating systems checked app entitlements, which were stored as XML and parsed by four different parsers in different places. Because the parsers could disagree on the same entitlements blob, an app could present one set of entitlements to the initial check and a different set when a specific action was queried; the bug was fixed in iOS 15.7.2 and macOS Monterey 12.6.2, with related hardening in iOS 16.2 and macOS Ventura 13.1.
Bottom line: Apple's fix for the original Psychic Paper bug was to add a fifth XML parser, and the newer DER binary format was adopted partly to prevent exactly this class of parser-disagreement flaw - yet Fratric's follow-up work found the entitlement-checking path still worth probing, including SHA1's continued acceptance for the Code Directory hash.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2022-42855
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026