Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 3: | Line 3: | ||
== BD-J exploits == | == BD-J exploits == | ||
=== FW <= 7.61 - BD-JB2 - | === FW <=7.61 - BD-JB2 - 0-day vulnerabilities by TheFloW === | ||
==== Credits ==== | |||
* TheFloW for the exploits finding. | |||
==== Implementations ==== | |||
Unreleased. | |||
==== Patched ==== | ==== Patched ==== | ||
''' | '''No''' on PS5 FWs <= 7.61. | ||
=== FW <= 4.51 - BD-JB - Five vulnerabilities chained by TheFloW === | === FW <=4.51 - BD-JB - Five vulnerabilities chained by TheFloW === | ||
See [https:// | ==== Credits ==== | ||
* CTurt for the idea based on FreeDVDBoot for PS2 | |||
* TheFlow for the exploits finding and public disclosure. See [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)]. | |||
* psxdev, sleirsgoevy and John Törnblom for the public implementations | |||
==== Implementations ==== | ==== Implementations ==== | ||
Line 33: | Line 43: | ||
* It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want. | * It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want. | ||
=== FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution === | === FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution === | ||
Line 54: | Line 48: | ||
Contrarly to PS4, on PS5 this exploit does not allow arbitrary usermode memory RW because of PS5 memory protections. However thanks to tricks it is possible to get usermode ROP code execution from this exploit. | Contrarly to PS4, on PS5 this exploit does not allow arbitrary usermode memory RW because of PS5 memory protections. However thanks to tricks it is possible to get usermode ROP code execution from this exploit. | ||
See also [https://www.psdevwiki.com/ps4/ | See also [https://www.psdevwiki.com/ps4/Working_Exploits#FW_9.00-9.04_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW]. | ||
==== Implementations ==== | ==== Implementations ==== | ||
Line 72: | Line 66: | ||
=== PS2 games savedata exploits === | === PS2 games savedata exploits === | ||
See [https://www.psdevwiki.com/ps4/ | See [https://www.psdevwiki.com/ps4/Working_Exploits#Usermode_Exploits_.28Game_Savedata.29]. | ||
=== PS4/PS5 PS2emu sandbox escape (mast1c0re) === | === PS4/PS5 PS2emu sandbox escape (mast1c0re) === | ||
See [https://www.psdevwiki.com/ps4/ | See [https://www.psdevwiki.com/ps4/Working_Exploits#PS4.2FPS5_PS2emu_sandbox_escape_.28mast1c0re.29]. | ||
== PS4 emulator exploits == | == PS4 emulator exploits == | ||
Line 84: | Line 78: | ||
= Kernel = | = Kernel = | ||
== FW 3.00-4.51 or 5.00 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457) == | |||
== FW 3.00-4.51 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457) | |||
See the [https://www.psdevwiki.com/ps4/Working_Exploits#FW_.3C.3D_7.02_-_IPV6_2292PKTOPTIONS_UaF_.28yielding_arbitrary_kernel_R.2FW.29_.28CVE-2020-7457.29 PS4 wiki]. | |||
=== Exploit Implementation === | === Exploit Implementation === | ||
* See also implementation for FreeBSD 9 or 12 or PS4. | * See also implementation for FreeBSD 9 or 12 or PS4. | ||
* [https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Kernel exploit implementation for PS5 3.00-4.51 by Specter (2022-10-02)] | * [https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Kernel exploit implementation for PS5 3.00-4.51 by Specter (2022-10-02)] | ||
=== Patched === | === Patched === | ||
'''Yes''' in PS5 FW 5.00 or 5.02. Invulnerable in PS5 FW 2.50 and below. | |||
'''Yes''' in PS5 FW 5.00. Invulnerable in PS5 FW 2.50 and below. | |||
---- | ---- | ||
== FW <= 4.03 - exFAT driver heap-based buffer overflow == | == FW <= 4.03 - exFAT driver heap-based buffer overflow == | ||
=== Exploit Implementation === | === Exploit Implementation === | ||
Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic. | |||
See the [https://www.psdevwiki.com/ps4/Working_Exploits#FW_.3C.3D_9.00_-_exFAT_driver_heap-based_buffer_overflow PS4 wiki]. | |||
=== Patched === | === Patched === | ||
'''Yes''' in PS5 FW 4.50. | '''Yes''' in PS5 FW 4.50. | ||
---- | ---- | ||
Line 157: | Line 103: | ||
== SMAP bypass (CVE-2021-29628) == | == SMAP bypass (CVE-2021-29628) == | ||
See also [https://www.psdevwiki.com/ps4/ | See also [https://www.psdevwiki.com/ps4/Working_Exploits#Kernel_SMAP]. | ||
=== Credits === | === Credits === | ||
* Discovered and disclosed publicly by m00nbsd. Disclosed to SIE on 2020-12-01. | * Discovered and disclosed publicly by m00nbsd. Disclosed to SIE on 2020-12-01. | ||
=== Analysis === | === Analysis === | ||
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd] | * [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd] | ||
* [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd] | * [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd] | ||
=== Bug Description === | === Bug Description === | ||
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched. | A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched. | ||
=== Patched === | === Patched === | ||
'''Yes''' in PS5 FW 2.30 or later according to dates. | '''Yes''' in PS5 FW 2.30 or later according to dates. | ||
---- | ---- | ||
Line 181: | Line 123: | ||
== Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel == | == Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel == | ||
See [https://www.psdevwiki.com/ps4/ | See [https://www.psdevwiki.com/ps4/Bugs_%26_Vulnerabilities#Partial_SAMU_KeyRings_bruteforce_by_missing_HMAC_length_check_in_secure_kernel]. | ||
Potentially vulnerable on PS5 FWs <= 4.03. | Potentially vulnerable on PS5 FWs <= 4.03. |