3 ms·

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by no

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?

muricula 1y ago
Look up iMessage's "blastdoor" sandbox: https://support.apple.com/guide/security/blastdoor-for-messages-and-ids-secd3c881cee/web https://support.apple.com/guide/security/blastdoor-for-messa...
- kaladin-jasnah 1y ago
  FORCEDENTRY bypassed this sandbox IIRC. That was a bug in the JBIG2 decoder.
jimmyl02 1y ago
unfortunately sandboxes also have bugs which allows for RCE. this is typically called a "full chain" because it chains together a series of bugs (initial decoder exploit + sandbox escape exploit) to gain full RCE
ladyanita22 1y ago
For some reason, Apple seems reluctant about using Rust on their operating systems.
- steve1977 1y ago
  That reason is probably called Swift. But they obviously still have many many system libraries written in Objective-C, plain C or C++. I don't see them using Rust when they have their own language under their full control, especially since both are targeting LLVM anyway.
GoblinSlayer 1y ago
Also image formats are fairly stable, so they are a good candidate for a verified F* parser. Not sure how easy it is for pdf, maybe start with a reasonable subset of it.
- mschuster91 1y ago
  Good luck doing that for stuff like PDF which can include JavaScript in the PDF file itself, or SVG+PDF which both can include raw font files, another reliable source of exploits.
  - GoblinSlayer 1y ago
    PDF/A-1 and PDF/UA require unicode mapping, so embedded font files might be not as critical, you can just render unicode text, and javascript is routinely banned for being inaccessible.
  - Wowfunhappy 1y ago
    Do any PDF readers other than Adobe's support JS? Apple's certainly does not, unless something has changed recently.
Hilift 1y ago
Apple should formalize the iMessage de facto DeviceAndAccountTakeover() API call. I lost count how many zero-click it has. Tim Apple can take the privacy high road all day but it doesn't matter if the code is rotten. https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/ https://citizenlab.ca/2025/06/first-forensic-confirmation-of... https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer... https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/ https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage... https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/ https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...
- deleted 1y ago
  [deleted]
saagarjha 1y ago
This isn't just an iOS thing, and they do sandbox it. Parsers are hard.

is it me or does ios have a myriad of cves in in the image processing/decoder stack? You'd think they'd sandbox in some kind of memory safe framework/lang by now?

muricula 1y ago

Look up iMessage's "blastdoor" sandbox: https://support.apple.com/guide/security/blastdoor-for-messages-and-ids-secd3c881cee/web https://support.apple.com/guide/security/blastdoor-for-messa...

kaladin-jasnah 1y ago
FORCEDENTRY bypassed this sandbox IIRC. That was a bug in the JBIG2 decoder.

jimmyl02 1y ago

unfortunately sandboxes also have bugs which allows for RCE. this is typically called a "full chain" because it chains together a series of bugs (initial decoder exploit + sandbox escape exploit) to gain full RCE

ladyanita22 1y ago

For some reason, Apple seems reluctant about using Rust on their operating systems.

steve1977 1y ago
That reason is probably called Swift. But they obviously still have many many system libraries written in Objective-C, plain C or C++. I don't see them using Rust when they have their own language under their full control, especially since both are targeting LLVM anyway.

GoblinSlayer 1y ago

Also image formats are fairly stable, so they are a good candidate for a verified F* parser. Not sure how easy it is for pdf, maybe start with a reasonable subset of it.

mschuster91 1y ago
Good luck doing that for stuff like PDF which can include JavaScript in the PDF file itself, or SVG+PDF which both can include raw font files, another reliable source of exploits.
- GoblinSlayer 1y ago
  PDF/A-1 and PDF/UA require unicode mapping, so embedded font files might be not as critical, you can just render unicode text, and javascript is routinely banned for being inaccessible.
- Wowfunhappy 1y ago
  Do any PDF readers other than Adobe's support JS? Apple's certainly does not, unless something has changed recently.

Hilift 1y ago

Apple should formalize the iMessage de facto DeviceAndAccountTakeover() API call. I lost count how many zero-click it has. Tim Apple can take the privacy high road all day but it doesn't matter if the code is rotten. https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/ https://citizenlab.ca/2025/06/first-forensic-confirmation-of... https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/ https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer... https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/ https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage... https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hacked-with-suspected-nso-group-imessage-zero-click-exploit/ https://citizenlab.ca/2020/12/the-great-ipwn-journalists-hac...

deleted 1y ago
[deleted]

saagarjha 1y ago

This isn't just an iOS thing, and they do sandbox it. Parsers are hard.