The Deathray: A simple way for an untrusted site to freeze a Mac
summary
A vulnerability in how macOS handles WebGPU shaders allows an untrusted website to freeze the entire system by creating an infinite loop. This occurs because the graphics processor becomes unresponsive, which subsequently crashes the WindowServer and triggers a kernel panic. While Apple does not classify this as a security vulnerability, it demonstrates a fundamental failure in shader pre-emption on M-series Macs.
key points
- The attack works by using a compute shader with an infinite loop that blocks a vertex shader from accessing a shared data buffer, eventually locking up the GPU and the system UI.
- Apple's previous attempts to fix similar WebGL issues focused on input validation to detect loops, but this is an ineffective long-term solution due to the halting problem.
- The system's architecture, where GPU pre-emption is handled by the ASC coprocessor firmware rather than the OS kernel, may complicate the implementation of a robust fix.
who should read it
Mac users and security researchers interested in browser vulnerabilities, GPU architecture, and the definition of security issues.
discussion positive
consensus
Commenters generally agree that WebGPU increases the browser's attack surface, potentially enabling system-wide freezes or fingerprinting. While some argue that these capabilities are necessary for modern web applications, others believe the browser should remain a document viewer rather than a full application platform. There is a shared concern that denial-of-service vulnerabilities, while not compromising data, are still significant security flaws.
top insight
The GPU differs from the CPU in that it is often not multiplexed by the kernel's scheduler, meaning a malicious shader can lock out other processes, including the WindowServer. This explains why a browser-based GPU hang can freeze an entire operating system rather than just a single application tab.
Generated by an LLM from the article and thread. Check the sources before relying on it.