Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 827: Line 827:
==== Credits ====
==== Credits ====
* 2021-09-24 m00nbsd for finding the vulnerability
* 2021-09-24 m00nbsd for finding the vulnerability
* 2022-05-04 martin of NetBSD for fixing the vulnerability publicly in NetBSD 8 and 9
* 2022-05-11 m00nbsd for disclosing the vulnerability publicly on HackerOne
* 2022-05-11 m00nbsd for disclosing the vulnerability publicly on HackerOne


==== Analysis ====
==== Analysis ====
* [https://hackerone.com/reports/1350653 HackerOne report by m00nbsd (2021-09-24)]
[https://hackerone.com/reports/1350653 HackerOne report by m00nbsd (2021-09-24)]
* [http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2022-001.txt.asc NetBSD Security Advisory about CVE-2022-29867 (2022-05-04)]


==== Bug Description ====
==== Bug Description ====
The PlayStation 4 has a kernel PPPoE driver, that originates from NetBSD. This driver has a kernel heap overflow vulnerability, that an attacker can remotely trigger over the LAN, with the ability to control both the contents that are overflown and their sizes.
The PlayStation 4 has a kernel PPPoE driver, that originates from NetBSD. This driver has a kernel heap overflow vulnerability, that an attacker can remotely trigger over the LAN, with the ability to control both the contents that are overflown and their sizes.
Extract of NetBSD 8.3 changelog:
<pre>
sys/net/if_pppoe.c 1.179
pppoe(4): fix CVE-2022-29867 - discovery phase local network
mbuf corruption.
[martin, ticket #1740]
Do not allocate mbuf clusters when the caller (eroneously) asks
for more than MCLBYTES size, instead fail the allocation.
When we have received multiple PADO offer packets in the discovery
phase, do not combine tags from different packets. We are supposed
to pick one PADO packet and continue session establishment with that.
The second bug could cause code to trigger the first and create
invalid response packets and also overwrite data outside of
the allocated mbuf cluster.
Fixes CVE-2022-29867.
</pre>
Diff after fix commit in NetBSD 8:
<source lang="C">
--- src/sys/net/if_pppoe.c 2020/02/13 19:37:39 1.125.6.10
+++ src/sys/net/if_pppoe.c 2022/05/04 15:36:35 1.125.6.11
@@ -1,4 +1,4 @@
-/* $NetBSD: if_pppoe.c,v 1.125.6.10 2020/02/13 19:37:39 martin Exp $ */
+/* $NetBSD: if_pppoe.c,v 1.125.6.11 2022/05/04 15:36:35 sborrill Exp $ */
/*-
  * Copyright (c) 2002, 2008 The NetBSD Foundation, Inc.
@@ -30,7 +30,7 @@
  */
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.125.6.10 2020/02/13 19:37:39 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.125.6.11 2022/05/04 15:36:35 sborrill Exp $");
#ifdef _KERNEL_OPT
#include "pppoe.h"
@@ -871,6 +871,10 @@ breakbreak:;
}
sc->sc_ac_cookie_len = ac_cookie_len;
memcpy(sc->sc_ac_cookie, ac_cookie, ac_cookie_len);
+ } else if (sc->sc_ac_cookie) {
+ free(sc->sc_ac_cookie, M_DEVBUF);
+ sc->sc_ac_cookie = NULL;
+ sc->sc_ac_cookie_len = 0;
}
if (relay_sid) {
if (sc->sc_relay_sid)
@@ -886,6 +890,10 @@ breakbreak:;
}
sc->sc_relay_sid_len = relay_sid_len;
memcpy(sc->sc_relay_sid, relay_sid, relay_sid_len);
+ } else if (sc->sc_relay_sid) {
+ free(sc->sc_relay_sid, M_DEVBUF);
+ sc->sc_relay_sid = NULL;
+ sc->sc_relay_sid_len = 0;
}
memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest);
callout_stop(&sc->sc_timeout);
@@ -1313,6 +1321,9 @@ pppoe_get_mbuf(size_t len)
{
struct mbuf *m;
+ if (len + sizeof(struct ether_header) > MCLBYTES)
+ return NULL;
+
MGETHDR(m, M_DONTWAIT, MT_DATA);
if (m == NULL)
return NULL;
</source>


==== Exploit Implementation ====
==== Exploit Implementation ====
* PoC (poc.c) by m00nbsd not disclosed publicly
* None


==== Patched ====
==== Patched ====
'''Yes''' in 9.03 FW according to Specter by diffing PS4 9.00 and 9.03 kernels
'''Yes''' in 9.03 FW according to Specter by diffing 9.00 and 9.03 kernels
----
----


Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/Vulnerabilities"