A proof of concept has been published online to exploit a problem found in the WebKit engine, notably used by the Safari browser. After loading an HTML page containing special CSS code, iOS freezes and reboots.
The problem is exploited through the use of the backdrop-filter CSS effect, applied to all div elements on the page. The backdrop filter is a relatively new CSS feature that lets you blur or distort the colors in the area behind an element. Such an operation requires considerable resources, which has long been a concern for some developers.
The validity of these concerns over the weekend was confirmed by the developer and security specialist Sabri Haddouche, who discovered the problem. The researcher posted the PoC exploit on his Twitter link, and also posted a demonstration video of the attack, which caused the smartphone to reset. Depending on the operating system version, the attack either causes a simple restart and a user interface reboot, or triggers a kernel panic that also leads to a reboot.
— Sabri (@pwnsdx) September 15, 2018
The researcher also created a special page to demonstrate the problem in action.
In this case, Addush indicates that the bug affects not only iOS but may also have a negative impact on macOS. According to the researcher, in its current form (HTML and CSS only), the attack “freezes” Safari and slows down macOS for a good minute, and only then can the user close the problematic tab.
A more serious attack on the desktop version of the browser would require modifying the exploit and adding JavaScript. However, the researcher did not dare publish this exploit, because the problem persists even after the device is restarted: Safari reloads the malicious page and the cycle starts again.
The specialist has already informed Apple engineers of the vulnerability and said they are looking into the issue.
