DNGerousLINK: A Deep Dive into WhatsApp 0-Click Exploits on iOS and Samsung Devices

DNGerousLINK: A Deep Dive into WhatsApp 0-Click Exploits on iOS and Samsung Devices

Speakers: Zhongrui Li, Yizhe Zhuang, Kira Chen

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=cbSgKmLA1AI

Overview

This talk, presented by Zhongrui Li ("Nun"), Yizhe Zhuang, and Kira Chen from DarkMatter, provides a comprehensive technical analysis of recent zero-click attack chains targeting WhatsApp on both iOS and Samsung devices. The presentation meticulously dissects how a critical vulnerability in Apple's Image I/O framework, specifically within its DNG decompression functions (CVE-2023-41064), was leveraged to compromise iOS devices via WhatsApp. Furthermore, the researchers detail their independent discovery of multiple previously unknown zero-day vulnerabilities in Samsung's proprietary image libraries, libimagecodec_qrm.so, which were also susceptible to DNG-based exploits.

The significance of this research lies in its exploration of highly sophisticated, nation-state-level attack techniques that exploit fundamental software components responsible for handling common file formats like DNG images. These zero-click vulnerabilities allow attackers to compromise devices without any user interaction, making them exceptionally potent and difficult to detect. The talk not only sheds light on the intricacies of these exploits but also underscores the persistent challenges in securing widely used "super apps" and their underlying system libraries against such advanced threats, highlighting the gaps in mitigation strategies for third-party applications compared to first-party system components.

Background

▶ Watch: Introduction to WhatsApp zero-click research and context (0:00)

The landscape of mobile security has been increasingly dominated by sophisticated zero-click attacks, particularly targeting "super apps" like WhatsApp, Signal, WeChat, and iMessage due to their massive user bases and extensive feature sets. These applications, often central to personal and professional communication, present attractive targets for nation-state actors. Historically, zero-click vulnerabilities have emerged in various forms, from WhatsApp's VoIP stack in 2019 to iMessage exploits like ForceEntry (2021) using malicious PDF files and BlastPass (2023) leveraging WebP vulnerabilities. The recurrence of such attacks underscores a persistent challenge in securing complex software ecosystems.

The story for this research began with the widely publicized iOS bug, CVE-2023-41064, fixed urgently by Apple in iOS 16.6.1 and macOS 13.5.2 in August 2023. This vulnerability, described as potentially exploited "in an extremely sophisticated attack," resided within the Image I/O framework, specifically impacting DNG decompression functions. DNG (Digital Negative) is an open, non-proprietary raw image format primarily used for storing high-quality photographic data. It is essentially an extension of the TIFF format and comprises three main parts: a header, Image File Directories (IFDs) containing metadata (like width, height, and compression type), and a data area that stores raw, often compressed, pixel data. DNG supports various compression methods, including uncompressed, lossless JPEG, and lossy JPEG. Crucially, DNG files can also include op code lists, which specify extra processing steps during parsing, making their handling complex and prone to errors. The widespread use of DNG, combined with its intricate parsing logic, makes it a prime target for attackers seeking to exploit vulnerabilities in image processing libraries across different platforms.

Key Findings

▶ Watch: Quick introduction to the DNG image file format (3:00)

The research yielded several critical findings across both iOS and Samsung platforms. For iOS, the team confirmed and analyzed CVE-2023-41064, a DNG processing vulnerability in Apple's Image I/O framework. They discovered that while initial analysis pointed to an integer overflow in tile_width height calculations, the actual root cause was a subtle logic error in the lossy JPEG unpacker, where the loop limit for decompression (width 2) was hardcoded, failing to account for images with num_components (channels per pixel) other than two. When num_components was set to one, this discrepancy led to an out-of-bounds write, causing a crash.

The most significant finding regarding WhatsApp was the identification of CVE-2023-55177, a zero-click vulnerability on iOS, iPadOS, and iPadOS. The researchers meticulously reverse-engineered how the DNG bug could be triggered in WhatsApp without user interaction. They discovered that the RequestURLPreview message type, intended for linked devices (e.g., WhatsApp Web) to offload URL preview generation to the primary mobile device, could be maliciously forged. By bypassing client-side authorization checks that incorrectly trusted all "peer" messages, an attacker could send a RequestURLPreview message containing a malicious DNG URL to any victim's phone number. The victim's device, acting as a "linked device" for the attacker, would then automatically fetch and parse the DNG image, triggering the Image I/O vulnerability and leading to a crash.

On the Samsung front, the team discovered two novel zero-day vulnerabilities in the proprietary libimagecodec_qrm.so library. The first was an integer overflow in the QRM_DNGStream::getData function, where a 32-bit offset variable, used to track read progress, would overflow after processing approximately 2GB of data. This led to a negative offset and a subsequent heap out-of-bounds write. The second zero-day was found within an op code handler called fix_bad_pixels_constant, triggered by adapting an iOS DNG proof-of-concept. This discovery highlighted that Samsung's image processing was independently vulnerable, with one of these issues correlating with a Project Zero finding and potentially remaining unpatched at the time of the talk. The research also revealed that Samsung's IP service, which periodically scans and analyzes images, served as a likely trigger for these DNG vulnerabilities on Samsung devices.

Technical Deep Dive

▶ Watch: Understanding the attack vector through Image IO APIs (5:00)

The technical depth of this research spans intricate file format parsing, application-layer protocol exploitation, and memory corruption vulnerabilities.

DNG Format and Parsing Challenges

The DNG (Digital Negative) format, an extension of TIFF, stores raw image data. Its structure includes a header, Image File Directories (IFDs), and a data area. IFDs contain crucial metadata such such as width, height, samples_per_pixel (channels), bits_per_sample, and compression type. The data area, often compressed, can utilize methods like uncompressed, lossless JPEG (Type 7), or lossy JPEG. A unique feature of DNG is the inclusion of op code lists, which are extra processing steps applied during different stages of parsing (after reading raw data, after linear mapping, after demosaicing). There are 30 distinct op codes, each with specific functionality, and their complex handling frequently introduces vulnerabilities.

iOS DNG Vulnerability (CVE-2023-41064)

The initial investigation into Apple's patch for CVE-2023-41064 revealed significant changes in the RawCamera.bundle, particularly in DNG decompression functions. The researchers first attempted to trigger an integer overflow by setting tile_width and height to extremely large values, but an earlier check limited these to 20,000, preventing the overflow. However, through metadata manipulation, they discovered an older bug (fixed in iOS 15.4, found on 15.2) where the product of image_width and image_height was unchecked, leading to an out-of-bounds read/write when negative.

The actual vulnerability (CVE-2023-41064) was in the lossy JPEG unpacker. This function allocates a buffer based on width height samples_per_pixel. It then iterates over height and width, and for each pixel, loops over channels to decompress data. The critical flaw was that the loop limit for processing a row was hardcoded as width 2, while the actual pixel size was determined by num_components. If num_components was 1 (e.g., a grayscale image), the loop would run twice as many times as intended (width 2 instead of width * 1), causing an out-of-bounds write into the heap buffer. This subtle discrepancy between expected and actual data sizes is a classic source of memory corruption.

WhatsApp Zero-Click Exploitation (CVE-2023-55177)

The WhatsApp zero-click attack surface encompasses protocol handling, file format parsing, and message processing. The team focused on the latter, specifically how WhatsApp handles URLs. They quickly ruled out the common URL preview feature, where the sender generates a thumbnail and sends it as part of an extendedTextMessage, because the advisory indicated the URL parsing happened on the targeted device, not the sender.

The breakthrough came with the discovery of the RequestURLPreview message type in WhatsApp's internal Protobuf definitions. This message type is crucial for linked devices (e.g., WhatsApp Web clients) which lack the system libraries to generate URL previews independently. When a user types a URL in WhatsApp Web, a RequestURLPreview message, containing the URL, is sent to the primary mobile device. The mobile device, without user interaction, fetches the URL, parses its content (including images), generates a thumbnail, and sends it back to the web client. This process makes the mobile device a "server" for linked device requests.

The critical vulnerability was the incomplete authorization of linked devices. WhatsApp's processPayload function, responsible for determining whether to handle an incoming message, contained a flaw. It first checks if a message is isPostedFromPeer (from a linked device), which is inherently trusted. If not, it checks isProtocolMessage. Finally, it consults a whitelist of message types allowed from non-peer devices. The PairDataOperationRequest message type, which encapsulates RequestURLPreview, corresponds to type 16 and was present on this whitelist. This meant that an attacker could forge a PairDataOperationRequest message (containing a malicious DNG URL) and send it to any phone number. The victim's device would then process this message as if it were a legitimate request from its own linked device, automatically fetching and parsing the malicious DNG, triggering CVE-2023-41064, and crashing the application. Since WhatsApp messages are end-to-end encrypted, the server cannot inspect the message content, leaving client-side checks as the only defense, which in this case, failed.

A practical challenge for reproduction was WhatsApp's HTTP Range header, which limits fetched image sizes. The existing DNG PoC for iOS was large (tens of megabytes). The researchers had to craft a smaller DNG file specifically designed to trigger the bug while adhering to WhatsApp's size constraints.

Samsung DNG Vulnerabilities

Samsung's libimagecodec_qrm.so library, responsible for DNG parsing, was identified as the vulnerable component. Initial bindiff analysis of patched versions (post-September 2023 advisory) showed three main differences:

1. A check in opcode_map_table_initialize limiting op_code_count to less than 1 million.
2. A check in do_apply function, limiting op_code_type to between 1 and 13.
3. A limit on the size field during unknown op code initialization (roughly 3 million in hex).

The researchers argued that these patches were primarily mitigations against exploitation (e.g., heap spraying, restricting attacker control) rather than fixes for the root vulnerability. A 1 million op code count, for instance, only allocates a few tens of megabytes, which isn't an excessive memory allocation for modern phones.

Unable to pinpoint the root cause from the patches, they debugged a crafted DNG with an extremely large size field (2GB) hoping for a null pointer dereference. Instead, they hit a crash at a heap address, leading to the discovery of a true zero-day:

1. Zero-Day 1: Integer Overflow in QRM_DNGStream::getData: This function is central to reading DNG data. It reads requested sizes in chunks of 0x1000 bytes. An internal offset variable, stored as a 32-bit integer, tracks the amount of data already read. When processing large files (around 2GB), this offset would overflow, becoming negative (0x7FFFFFFF to negative). Subsequent memory copy operations would then attempt to write to a very large negative offset, resulting in a heap out-of-bounds write and a crash.
2. Zero-Day 2: Vulnerability in fix_bad_pixels_constant op code: By adapting an iOS DNG PoC, another crash was observed within the fix_bad_pixels_constant op code handler. This indicated a second, distinct DNG parsing flaw. This bug later collided with a finding by Project Zero and was reportedly not fully patched at the time of the talk.

On Samsung devices, the IP service (likely for AI-related image analysis) periodically scans and parses images stored on the phone, making it a natural trigger for these DNG vulnerabilities without direct user interaction. The talk also highlighted how Samsung's advisories and CVE numbering (consecutive IDs, delayed assignment) suggested multiple, related exploit chains targeting DNG parsing in 2023.

Demo / Proof of Concept

▶ Watch: Deep dive into the real DNG unpacker bug (8:00)

The presentation included a live demonstration of the WhatsApp zero-click attack on iOS. The setup involved:

1. Verifying the vulnerable WhatsApp client versions on Mac OS, iOS, and iPad OS.
2. Logging into an attacker's WhatsApp account, which was not related to the victim's account and not in their contacts.
3. The attacker then input the victim's phone number into their WhatsApp client.
4. Crucially, the victim's device, acting as the "linked device" target, automatically attempted to fetch the malicious DNG image embedded in the forged RequestURLPreview message.
5. The server received the request, and immediately after the victim's device started processing the DNG, the WhatsApp application crashed, confirming the successful trigger of the ImageIO vulnerability. This visual proof underscored the zero-click nature of the exploit.

Defensive Implications

▶ Watch: Confirmation of DNG bug's use in WhatsApp attacks (10:00)

The findings from this research carry significant implications for developers, security researchers, and end-users:

• Robust Input Validation and File Format Parsing: The DNG vulnerabilities on both iOS and Samsung highlight the critical need for extremely robust and secure parsing of complex file formats. Developers must implement comprehensive bounds checking, type validation, and error handling at every stage of data processing, especially when dealing with metadata that can influence memory allocations and loop iterations. The width num_components vs. width 2 bug is a prime example of a subtle logic error with severe security consequences.
• Secure Deserialization and Protocol Handling: The WhatsApp zero-click attack demonstrates that even well-intentioned features like "linked device" functionality can become an attack vector if authorization and message processing logic are not airtight. Applications must rigorously validate the origin and intent of all incoming messages, especially those that trigger complex actions like URL fetching and file parsing, even if they appear to originate from "trusted" peer devices. WhatsApp's fix, adding additional checks for message types like PairDataOperationRequest to ensure they only originate from truly linked devices, is a direct response to this.
• System-Wide Image Processing Services: The discovery that Samsung's IP service could trigger DNG vulnerabilities underscores a broader risk. Background services that automatically scan and process user-supplied or network-fetched content (e.g., image galleries, antivirus, AI features) present silent and persistent attack surfaces. These services must be designed with the highest security standards, isolated, and their parsing components hardened.
• Mitigation Gap for Third-Party Applications: The talk emphasized that many modern hardware-backed mitigations (like PAC - Pointer Authentication Codes, BTI - Branch Target Identification, CFI - Control-Flow Integrity) are often less thoroughly deployed in third-party applications, even those pre-installed or developed by device vendors, compared to first-party system applications like iMessage. This disparity leaves a significant window for attackers. The slow rollout of technologies like MTE (Memory Tagging Extension) across the broader Android ecosystem further exacerbates this issue. Developers of "super apps" and device vendors must prioritize the adoption and effective deployment of these advanced mitigations.
• Continuous Auditing and Patching: The complex timeline of Samsung's vulnerabilities, where initial patches were exploitation mitigations rather than root cause fixes, and some issues remained unpatched for extended periods (or even at the time of the talk), highlights the need for continuous security auditing and prompt, comprehensive patching. Vendors must not only fix reported bugs but also deeply investigate the underlying architectural and design flaws that enable such vulnerabilities.

Key Takeaways

• Zero-click attacks on "super apps" remain a significant and persistent threat, often targeting complex file formats like DNG images.
• Subtle logic errors in image parsing libraries can lead to critical memory corruption vulnerabilities, as seen with the iOS DNG num_components bug (CVE-2023-41064).
• WhatsApp's "linked device" functionality (specifically RequestURLPreview messages) created a zero-click attack vector (CVE-2023-55177) due to insufficient client-side authorization checks.
• Samsung's proprietary image library (libimagecodec_qrm.so) contained multiple zero-day DNG vulnerabilities, including an integer overflow in QRM_DNGStream::getData and a bug in fix_bad_pixels_constant.
• Background services like Samsung's IP service can automatically trigger image parsing vulnerabilities, enabling silent zero-click exploitation without user interaction.
• There is a significant gap in the deployment of advanced security mitigations (PAC, BTI, CFI, MTE) in third-party applications compared to first-party system components, leaving them more vulnerable to sophisticated attacks.

About the Speaker(s)

The talk was presented by Zhongrui Li (also known as Nun), Yizhe Zhuang, and Kira Chen, all members of the DarkMatter team. Their collective expertise in vulnerability research and exploit development enabled this deep dive into complex zero-click attack chains. Zhongrui Li, as the opening speaker, guided the audience through the initial iOS DNG vulnerability analysis. Yizhe Zhuang detailed the intricate WhatsApp zero-click exploitation mechanism, including the RequestURLPreview message type and the client-side authorization bypass. Kira Chen concluded the technical discussion by presenting the team's independent discovery of multiple zero-day vulnerabilities in Samsung's image processing library and outlining the broader implications for mobile security.