10 ms·
DoS exploit crashes iOS/OSX devices using WebKit
- deleted 13y ago[deleted]
- kawera 13y agoDoes not crash Safari 6.0.4 (7536.29.13) on OSX 10.7.5 for me.
- maqr 13y agoiOS is the only platform where I don't support full disclosure, or for that matter, any disclosure. It looks doubtful that this bug would be able to be used in a jailbreak anyway, but it's certain that Apple will patch it once it's known (and especially if it could be used to jailbreak).
- jonchang 13y agoAnyone know what Apple's timeline on patches for bugs like this are? TFA says that they've known about this for 6 months now.
- potatolicious 13y agoUsually this sort of bug would fall under "next point release". No privilege escalation, no potential for leaking private data - i.e., no giant legal/PR disaster waiting to happen means they will likely defer a patch until the next scheduled point release.
- ballard 13y agoCVE # on this?
- chroman 13y agoI don't know why, but I realized that CoreText is crashing with this combination of three Unicode characters http://tny.cz/87a09a7c http://tny.cz/87a09a7c
- mukundmr 13y agoWorks pretty good, LOL. I hope it gets fixed ASAP. You can try it out and report via the browser feedback information.
- nwh 13y agoIt's fixed in 10.9 and iOS7, so I imagine they'll backport a patch at some point. Though it's only a matter of time before somebody posts it here as a comment.
- joeblau 13y agoIs 10.9 usable?
- nwh 13y agoIt's not noticeably unusable.
- antimagic 13y agoUmmm, I wouldn't install it on a computer that you want to use for general computer usage. As a general rule, I advise people to wait until at least the .1 release, if not the .2 release for each new version. So using the beta is definitely a no-no, unless you actually need the beta, for testing your application against. Otherwise you can find pretty big things not working - printing, might not work on one release, or bluetooth preferences might not open on another, or Airplay video streaming might not work. You may have graphics glitches, or a run away process that kills battery life. It's simply not worth the pain if you don\t really need it, but if you do really need it, the pain is bareable if you grit your teeth.
- aroch 13y agoJust don't try to compile universal C binaries and you'll be fine
- untog 13y agoAnother argument for decoupling apps from OS. Would be great if this could be an update to a Safari app in the App Store...
- joeblau 13y agoI remember back in the day when you could send ̂ to people on AIM and crash their AIM clients.
- DanielRibeiro 13y agoPretty interesting discovery. Direct link: (WARNING THIS CAN KILL WEBKIT) https://zhovner.com/tmp/killwebkit.html https://zhovner.com/tmp/killwebkit.html
- semenko 13y agoAnd a similar tweet: (WARNING / CRASH) https://twitter.com/daken_/status/303784082599456768 https://twitter.com/daken_/status/303784082599456768
- tuananh 13y agoworks fine on Chrome dev running on ML.
- Groxx 13y agoFirefox nightly is fine too.
- brokenparser 13y agoGee, I wonder why.
- jawr 13y agoThis bug isn't particular to Chrome...
- deleted 13y ago[deleted]
- ianhawes 13y agoAaaaand I'm a dick.
- nthitz 13y agoWhat the hell did you think would happen? Get on Firefox and edit your comment while you still can please.
- deleted 13y ago[deleted]
- brokenparser 13y agoGet on Firefox So presumably he pasted the string right here, wow. Good one.
- adamzegelin 13y agoNot cool.
- adamzegelin 13y agoThis isn't a bug inside WebKit. It's a bug inside Apples CoreText font rendering framework. A `curl https://zhovner.com/tmp/killwebkit.html` https://zhovner.com/tmp/killwebkit.html` in iTerm2 crashes as well. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libvDSP.dylib 0x00007fff9080ead6 0x7fff907f2000 + 117462 1 com.apple.CoreText 0x00007fff8892cd5c TRun::TRun(TRun const&, CFRange, TRun::SubrangingStyle) + 850 2 com.apple.CoreText 0x00007fff8892c9ee CTGlyphRun::CloneRange(CTRun const*, CFRange, TRun::SubrangingStyle) + 142 3 com.apple.CoreText 0x00007fff8893b764 TLine::SetLevelRange(CFRange, unsigned char, bool) + 162 ⋮ 8 com.googlecode.iterm2 0x000000010003ce63 -[PTYTextView(Private) drawRun:ctx:initialPoint:] + 99 9 com.googlecode.iterm2 0x000000010003d498 -[PTYTextView(Private) _drawRuns:runs:] + 344 ⋮ 41 com.googlecode.iterm2 0x0000000100001bd4 start + 52
- deleted 13y ago[deleted]
- ballard 13y agoNice. on iOS: Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0: 0 libsystem_kernel.dylib 0x3a315e30 mach_msg_trap + 20 1 libsystem_kernel.dylib 0x3a315fd0 mach_msg + 48 2 CoreFoundation 0x3210c2b6 __CFRunLoopServiceMachPort + 126 3 CoreFoundation 0x3210afd6 __CFRunLoopRun + 814 4 CoreFoundation 0x3207e238 CFRunLoopRunSpecific + 352 5 CoreFoundation 0x3207e0c4 CFRunLoopRunInMode + 100 6 GraphicsServices 0x35c5d336 GSEventRunModal + 70 7 UIKit 0x33f9a2b4 UIApplicationMain + 1116 8 MobileSafari 0x000ff36e 0xf2000 + 54126 9 libdyld.dylib 0x3a25fb1c start + 0 ... Thread 2 name: WebThread Thread 2 Crashed: 0 WebCore 0x382fe95a WebCore::ComplexTextController::adjustGlyphsAndAdvances() + 522 1 WebCore 0x382fb94e WebCore::ComplexTextController::ComplexTextController(WebCore::Font const*, WebCore::TextRun const&, bool, WTF::HashSet<WebCore::SimpleFontData const*, WTF::PtrHash<WebCore::SimpleFontData const*>, WTF::HashTraits<WebCore::SimpleFontData const*> >*, bool) + 318 2 WebCore 0x382fb806 WebCore::ComplexTextController::ComplexTextController(WebCore::Font const*, WebCore::TextRun const&, bool, WTF::HashSet<WebCore::SimpleFontData const*, WTF::PtrHash<WebCore::SimpleFontData const*>, WTF::HashTraits<WebCore::SimpleFontData const*> >*, bool) + 18 3 WebCore 0x382ff990 WebCore::Font::getGlyphsAndAdvancesForComplexText(WebCore::TextRun const&, int, int, WebCore::GlyphBuffer&, WebCore::Font::ForTextEmphasisOrNot) const + 56 4 WebCore 0x382ff862 WebCore::Font::drawComplexText(WebCore::GraphicsContext*, WebCore::TextRun const&, WebCore::FloatPoint const&, int, int) const + 150 5 WebCore 0x3808 PS: I love the C++ namespace 'WTF.' EDIT: complete dump https://gist.github.com/6374524 https://gist.github.com/6374524
- augbot 13y agoPeople should put this link in the Apple Crash Report as proof.
- joshstrange 13y agoYou can't put in a chrome error report (The page will crash) I would assume the same will happen if you try to enter it in an Apple crash report.
- jmuguy 13y agoI'm really resisting sending this to my coworkers. Works via email as well, you can just turn Mail sync off and back on for the account to fix (on iOS)
- peter_tonoli 13y agoSeems to be a pretty devastating problem if you send the exploit text to someone in iMessage. Makes the phone immediately crash - when the phone has been restarted and the user clicks on "messages", it crashes again - I think that it'll need a system restore / hacking of the Messages datastore to fix. Put the exploit text into the SSID for an iOS personal hotspot - crashes iOS devices when they scan for SSID's to connect to.
- nickles 13y agoIt can be fixed by sending the attack again, then deleting the entire chat history with the attacker. (According to a comment the report linked to.)
- pessimizer 13y agoActually, just by the attacker sending a long enough text message to push the attack off the screen - which you can do yourself by sending a long text message to yourself from another phone, then forwarding that message to the attacker.
- zhovner 13y agoDid you test SSID?
- peter_tonoli 13y agoAs soon as the device found the exploited SSID name, the SSID selector would restart/crash, meaning that the user couldn't select a new SSID.
- nwh 13y agoUsing Unicode crashes my router, I learnt that previously.
- voltagex_ 13y agoTerrible router firmware strikes again. Which router are you using?
- signed0 13y agoThere was something similar earlier this year with typing 'File:///' in a OSX text field. http://thenextweb.com/shareables/2013/02/02/typing-these-eight-characters-will-crash-almost-any-application-on-your-mac/ http://thenextweb.com/shareables/2013/02/02/typing-these-eig...
- gmac 13y agoOn my iPad and I can only read half the comments here, then Safari exits: looks like jmuguy rather unhelpfully posted the characters in question.
- sanxiyn 13y agoThis seems to be a kind of bug that would be found by fuzz testing. Is apple not using fuzz testing, or what's going on?
- zurn 13y agoWhat kind of fuzzing heuristic would have found this in the haystack of Unicode permutations?
- Dylan16807 13y agoWell it's not just a single permutation. It'll take some deeper analysis to see how much fuzzing would be needed to find this bug.
- beyondcompute 13y ago> Since Apple doesn't show any reaction for about half a year. Why is this happening?
- prawn 13y agoMy Chrome (in OSX) tab crashes even scrolling past half-way in this comments thread. Doesn't happen in other comment threads or in Safari or Firefox. Any idea why? I use the HN comment collapse extension plus AdBlock, Ghostery, etc. Some sort of link pre-fetching I'm not aware of?
- syncopate 13y agoI've been looking at the stack trace in gdb a bit. And it seems that inside CoreText TStorageRange::SetStorageSubRange calls void vDSP_sveD(double *__vDSP_A, vDSP_Stride __vDSP_I, double *__vDSP_C, vDSP_Length __vDSP_N) with a negative length argument.
- yuhong 13y agoWonder if it is exploitable.
- syncopate 13y agoAFAIU, the length is negative but it is then treated as an unsigned integer by vDSP_sveD. So the function iterates over the given vector until there is a memory exception (As the length is very close to to UINT_MAX). It doesn't look very exploitable to me but it is surely annoying. I've found it a bit odd that neither TStorageRange::SetStorageSubRange nor vDSP_sveD do any kind of sanity checks for the values they calculate or which are passed to them.
- sigzero 13y agoFixed in Mavericks and iOS7 apparently. So a fix is probably coming soon.
- yolodicks 13y agoHOW DO I FIX THIS.
- neutral 13y agosend enough non malicious messages to put the malicious one out of the auto load area open messages, delete the conversation I had to send about 30 messages, each had about 200 words
- chroman 13y agoThis crash any app. Try to paste this Unicode combination into any text field and you'll get a crash. http://tny.cz/1a56d253 http://tny.cz/1a56d253
- chasedrgc1223 13y agoWow this actually crashes the entire Chrome browser on Mac OSX. This is the only one that fully crashes the browser instead of just the tab. The weird thing is, though, you need to copy paste it for it to crash not just view it. Weird huh
- augbot 13y agoJust tested on iOS 7 Safari on a gen3 iPad... The font looks great!
- ryanpetrich 13y agoHere's another: http://rpetri.ch/crash/ http://rpetri.ch/crash/
- nst021 13y agosame with $ python -c "u'\u0647\u0020\u0488\u0488\u0488' source: https://twitter.com/nst021/status/316124758469120000 https://twitter.com/nst021/status/316124758469120000
- snickler 13y agoWorks when being e-mailed to an apple phone also. Especially if you're using and ActiveSync enabled account. It will immediately crash the mail app until that e-mail message is deleted from another client.
- lxgr 13y agoDoes this also affect iOS 5 and lower? That would be really annoying, as devices stuck on that version aren't receiving updates anymore...
- humus 13y agoAnnone testen what happens when you use it as a computername? Could be a problem as well, since machines with fileshares are listed in the finders sidebar. When the SSID already produces such a screwup, that would be even worst.
- donald111 13y agosad
- donald111 13y agodonald
- donald111 13y agodasdasasdfsdf
- donald111 13y agosdfsdf
- donald111 13y agosdfsdf
- donald111 13y agoxaASDSQWS
- donald111 13y agoSSSSSSSSSSSSSSSSSSSSSSSSSSSS