Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 3: Line 3:
== BD-J exploits ==
== BD-J exploits ==


=== FW <= 7.61 - BD-JB2 - Path traversal sandbox escape by TheFloW ===
=== FW <=4.51 - Five vulnerabilities chained by TheFloW ===


See [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=10.71_-_BD-JB2_-_Path_traversal_sandbox_escape_by_TheFloW].
See [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)].


==== Patched ====
To wikify using PS4 wiki page.
 
'''Yes''' on PS5 FW 8.00.
 
=== FW <= 4.51 - BD-JB - Five vulnerabilities chained by TheFloW ===
 
See [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=9.00_-_BD-JB_-_Five_vulnerabilities_chained_by_TheFloW].
 
==== Implementations ====
 
* [https://github.com/psxdev/bd-jb PS5 BD-JB implementation by Antonio Jose Ramos Marquez (psxdev)]
* [https://github.com/john-tornblom/bdj-sdk/tree/master/samples/ps5-invoke-native PS5 BD-JB implementation by John Törnblom]
* [https://github.com/sleirsgoevy/bd-jb/tree/ps5 PS5 BD-JB implementation by sleirsgoevy]
* [https://github.com/TheOfficialFloW/bd-jb PS5 BD-JB implementation by TheFloW]
 
==== Patched ====
 
'''Yes''' partially on PS5 FWs > 4.50 (need to test). Probably unpatched on FW 4.51 and patched on FW 5.00.


== WebKit exploits ==
== WebKit exploits ==
Line 34: Line 17:
* It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want.
* It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want.


==== Patched ====
=== FW 3.00-4.50 - WebCore::CSSFontFaceSet vulnerabilities leading to addrof/fakeobj ===
 
'''No''' as of PS5 FW 5.10.
 
=== FW <= 5.50 - FrameLoader::loadInSameDocument UaF (CVE-2022-22620) leading to arbitrary RW ===
 
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_6.00-9.60_-_FrameLoader::loadInSameDocument_UaF_(CVE-2022-22620)_leading_to_arbitrary_RW].
 
==== Patched ====
 
'''Yes''' on PS5 FW 6.00.
 
==== Tested ====
 
Tested and working on PS4 FWs 6.00-9.60 and PS5 FWs 1.00-5.50.
 
=== FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution ===
 
Contrarly to PS4, on PS5 this exploit does not allow arbitrary usermode memory RW because of PS5 memory protections. However thanks to tricks it is possible to get usermode ROP code execution from this exploit.


See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_9.00-9.04_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW].
Contrarly to PS4, on PS5 this exploit does not allow arbitrary RW because of PS5 memory protections.


==== Implementations ====
See [https://www.psdevwiki.com/ps4/Working_Exploits#FW_9.00-9.03_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW].


* [https://github.com/ChendoChap/PS5-Webkit-Execution Implementation for PS5 by ChendoChap]
Tested working on PS4 FWs 9.00-9.03 and PS5 FWs 3.00-4.50. Untested: PS5 FWs 2.10-2.50.


==== Patched ====
Unpatched as of PS5 FW 4.50.
 
'''No''' as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00).
 
==== Tested ====
 
Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00.


== Game savedata exploits ==
== Game savedata exploits ==


=== PS2 games savedata exploits ===
Nothing yet.
 
See [https://www.psdevwiki.com/ps4/Vulnerabilities#Usermode_Exploits_.28Game_Savedata.29].
 
=== PS4/PS5 PS2emu sandbox escape (mast1c0re) ===
 
See [https://www.psdevwiki.com/ps4/Vulnerabilities#PS4.2FPS5_PS2emu_sandbox_escape_.28mast1c0re.29].


== PS4 emulator exploits ==
== PS4 emulator exploits ==
Line 84: Line 37:
= Kernel =
= Kernel =


== Physical memory readable by kernel (Meme Dumper) ==
== FW <= 4.50 - exFAT driver OOB ==
 
=== Credits ===
 
Discovered by cheburek3000. Released on 2023-02-07 by cheburek3000.
 
=== Bug Description ===
 
Steps:
 
1. Find kernel_pmap_store offset in kernel data segment. You can guess its location by specific signature (see guess_kernel_pmap_store_offset code). Luckily kernel_pmap_store has physical and virtual addresses for PML4.
 
2. Through physical and virtual addresses for PML4, you can find physical memory mapped directly to the kernel memory (DMAP). See PADDR_TO_DMAP macro and vmparam.h from FreeBSD for reference.
 
3. Use page tables to convert any kernel virtual address to physical address (see vaddr_to_paddr code).
 
4. Access data by physical address through DMAP.
 
=== Exploit Implementation ===
 
* [https://github.com/cheburek3000/meme_dumper]
 
=== Patched ===
 
'''No''' in PS5 FW 4.51.
----
 
== FW <= 8.20 - Remote vulnerabilities in spp (yielding kernel ASLR defeat) (CVE-2006-4304 and no-CVE) ==
 
See the [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=_11.00_-_Remote_vulnerabilities_in_spp_(yielding_kernel_ASLR_defeat)_(CVE-2006-4304_and_no-CVE) PS4 wiki].
 
=== Patched ===
 
'''Yes''' in PS5 FW 8.40.
----
 
== FW 3.00-4.51 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457) ==
 
See the [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_.3C.3D_7.02_-_IPV6_2292PKTOPTIONS_UaF_.28yielding_arbitrary_kernel_R.2FW.29_.28CVE-2020-7457.29 PS4 wiki].
 
=== Credits ===


* Discovered for PS4 and ported to PS5 by TheFloW.
Not yet exploited because no public usermode exploit has been released yet.


=== Exploit Implementation ===
See [https://www.psdevwiki.com/ps4/Working_Exploits#FW_.3C.3D_9.00_-_exFAT_driver_OOB]


* See also implementation for FreeBSD 9 or 12 or PS4.
Not yet patched.
* [https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Kernel exploit implementation for PS5 3.00-4.51 by Specter (2022-10-02)]


=== Patched ===
== TheFloW's kernel exploit ==


'''Yes''' in PS5 FW 5.00. Invulnerable in PS5 FW 2.50 and below.
Not released yet.
----


== FW <= 4.03 - exFAT driver heap-based buffer overflow ==
See [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)].


See the [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_.3C.3D_9.00_-_exFAT_driver_heap-based_buffer_overflow PS4 wiki].
Potentially unpatched.
 
=== Credits ===
 
Discovered by TheFloW. Disclosed by ChendoChap.
 
=== Exploit Implementation ===
 
Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic.
 
=== Patched ===
 
'''Yes''' in PS5 FW 4.50.
----


== SMAP bypass (CVE-2021-29628) ==
== SMAP bypass (CVE-2021-29628) ==


See also [https://www.psdevwiki.com/ps4/Vulnerabilities#Kernel_SMAP].
* Discovered and disclosed publicly by m00nbsd. Disclosed to Sony on 2020-12-01.
 
=== Credits ===
 
* Discovered and disclosed publicly by m00nbsd. Disclosed to SIE on 2020-12-01.


=== Analysis ===
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP is not coming from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.


* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd]
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd]
* [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd]
* [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd]


=== Bug Description ===
See also [https://www.psdevwiki.com/ps4/Working_Exploits#Kernel_SMAP].
 
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.
 
=== Patched ===


'''Yes''' in PS5 FW 2.30 or later according to dates.
Patched on PS5 FW 2.30 or later according to dates.
----


= Secure Kernel =
= Secure Kernel =
Line 181: Line 70:
== Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel ==
== Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel ==


See [https://www.psdevwiki.com/ps4/Vulnerabilities#Partial_SAMU_KeyRings_bruteforce_by_missing_HMAC_length_check_in_secure_kernel].
See [https://www.psdevwiki.com/ps4/Bugs_%26_Vulnerabilities#Partial_SAMU_KeyRings_bruteforce_by_missing_HMAC_length_check_in_secure_kernel].


Potentially vulnerable on PS5 FWs <= 4.03.
Potentially vulnerable on PS5 FWs <= 4.03.
Please note that all contributions to PS5 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS5 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps5/Vulnerabilities"