- 1 WebKit/Userland Exploits
- 2 Kernel Exploits
- 3 First Steps
WebKit/??? exploit on System Firmware 3.550.000 + 3.70 (Phat PS4 NOT PRO) and lower (patched in 4.000.000)
heap buffer overflow in butterfly access on uaf_target
NamedObj Type Confusion (namedobj)
Type confusion in the namedobj system once exploited can lead to an arbitrary free() allowing an attacker to craft a use-after-free situation to obtain code execution in ring0.
Yes in 4.06 FW
Dynamic Library Prepare Close (dlclose)
Integer overflow in the sys_dynlib_prepare_dlclose() system call can lead to a heap overflow causing memory corruption, allowing an attacker to obtain code execution in ring0.
Yes in 2.00 FW
Allows an attacker to corrupt the GS base address and obtain code execution in ring0 by abusing the IRET instruction.
Yes in 2.00 FW
It seems at some point after the 1.76 FW, ASLR (Address Space Layout Randomization) was enabled in the kernel. This means that to properly exploit the kernel to escalate privileges, an information disclosure vulnerability will most likely be needed to defeat ASLR and locate the kernel in memory.
A possible exploit has been found in VidNow App in the Playstation Store App .
PATCHED: Sony has hotfixed this exploit via content hashing the file while in transit.
UPDATE: Some have managed to reverse the hotfix but the method is not known - the PS4 checks the content
hash HTTP header from the HMAC header.
A possible exploit has been found in the SnagFilms App in the Playstation Store App.
Arbitrary code execution in memory has been demonstrated, although so far the system will throw an exception in the programs memory before the payload finishes loading.
If you craft a small enough payload and/or a payload that load's without causing an exception in program memory you can most likely get code execution working.