Bugs

Usermode

Internet Browser

Bug in nested loop requests out of a standard tag (Vulnerability Laboratory ID 187) leading to DoS and PS3 OS crash

Credits

• Anonymous for discovering the vulnerability and publicly disclosing it (2011-06-18)

Analysis

• Write-up and PoC by Anonymous (2011-06-18)

Bug description

A denial of service vulnerability is detected on the PS3 Internet Browser. The bug is located in the browser when including specific nested loop requests out of a standard tag. After exploitation of the web browser, the System Software crashes via heap freeze when memory full on main menu switch back.

Implementation

• Write-up and PoC by Anonymous (2011-06-18)

Patched

Maybe around 2011-06-18 but anyway not useful except for DoS.

Unlimited value of HTMLSelect.length() (CVE-2009-1692, CVE-2009-2541, GSEC-TZO-26-2009) leading to DoS and PS3 OS crash

Credits

• Thierry Zoller for discovering the vulnerability and publicly disclosing it (2008-10-19)

Analysis

• Bugzilla report (2008-10-19)
• CVE-2009-2541 details

Bug description

The PS3 Web browser can make the PS3 crash via a large integer value set for the length property of a Select object in a JavaScript script.

Implementation

• Write-up and PoC by Thierry Zoller (2009)

Patched

Maybe around 2009-09-04 but anyway not useful except for DoS.

PlayStation Network

PSN Account

PSN security intrusion

Patched

Yes since 3.61 enforced password change

Sony PSN Account Service - Password Reset Vulnerability

• [1]

Patched

Yes since 2012-05-01.

Syscon Firmware

RTC

2015 leap year bug

To be documented.

The PS3 may be affected by the "leap second 23:59:60" bug that happens when the clock gets at 2015 June 30, 23h 59m 60s.

Could it be used for anything else than DoS?

Patched

Maybe.

2010 leap year bug

To be documented by diffing PS3 3.30 and 3.40 PUPs, notably the RTC module and the FAT PS3 Syscon firmware patch.

The PS3 is affected by the 2010 leap year bug that happens when the clock gets at 2010 February 28, 23h 59m 60s.

The bug caused the console to treat 2010 as a leap year and so change the date at midnight GMT to 29 February rather than 1 March. The new, slimline PS3s were not affected.

"The current date and time could not be obtained. (8001050F)" As a consequence, another error triggered is "An error has occurred. You have been signed out of PlayStation Network (8001050F)".

Could it be used for anything else than DoS? CelesteBlue's hypothesis is that the bug causes a reset of one of the RTC clocks (secure, network, user-defined, etc.) to Jan 1, 2000, whilst other are not, and that difference is detected by the console as a security issue so it disables PlayStation Network access, and probably also Dev/Test Kit activation as long as the clock are not synchronized again.

• https://www.theregister.com/2010/03/02/ps3_psn_access_bug_bypassed/
• https://www.wired.com/2010/03/apocalyps3/
• https://web.archive.org/web/20100302165710/http://blog.us.playstation.com/2010/03/latest-info-on-playstation-network-status/
• https://web.archive.org/web/20120415101201/http://www.gamesradar.com/psn-error-8001050f-sonys-official-response/
• https://www.youtube.com/watch?v=1CJ9Q8bG-0s

Patched

Yes since 3.40. It was probably patched via a RTC module update and/or a Syscon firmware update.

Unsorted

Either usermode or DRM piracy

MP4 format video files security vulnerability

To be documented by diffing PS3 3.20 and 3.21 MP4 decoding libraries.

From PlayStation®3 system software version 3.21 official changelog: "The PlayStation®3 system software version 3.21 update includes the following: [...] A security patch was added to address security vulnerabilities that may occur when playing MP4 format video files."

It is unsure what Sony means by "security vulnerability" here. It could be a bypass of video files DRM protections, and not DoS or arbitrary code execution.

Patched

Yes since 3.21.