Bugs & Vulnerabilities: Difference between revisions

From PS5 Developer wiki
Jump to navigation Jump to search
(Added info about SMAP bypass)
 
(17 intermediate revisions by the same user not shown)
Line 1: Line 1:
= Usermode =


Modal Browser:
== BD-J exploits ==
# It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel- the browser will just display that response. the downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but its useful for directing the browser anywhere you want.


SMAP bypass:
=== FW <=7.61 - BD-JB2 - 0-day vulnerabilities by TheFloW ===
# There is a vulnerability in FreeBSD 12 that allows SMAP to be bypassed by userland. There is a very high probability that it affects the PS5 but it was not confirmed yet. [https://hackerone.com/reports/1048322 Source].
 
==== Credits ====
 
* TheFloW for the exploits finding.
 
==== Implementations ====
 
Unreleased.
 
==== Patched ====
 
'''No''' on PS5 FWs <= 7.61.
 
=== FW <=4.51 - BD-JB - Five vulnerabilities chained by TheFloW ===
 
==== Credits ====
 
* CTurt for the idea based on FreeDVDBoot for PS2
* TheFlow for the exploits finding and public disclosure. See [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)].
* psxdev, sleirsgoevy and John Törnblom for the public implementations
 
==== Implementations ====
 
* [https://github.com/psxdev/bd-jb PS5 BD-JB implementation by Antonio Jose Ramos Marquez (psxdev)]
* [https://github.com/john-tornblom/bdj-sdk/tree/master/samples/ps5-invoke-native PS5 BD-JB implementation by John Törnblom]
* [https://github.com/sleirsgoevy/bd-jb/tree/ps5 PS5 BD-JB implementation by sleirsgoevy]
* [https://github.com/TheOfficialFloW/bd-jb PS5 BD-JB implementation by TheFloW]
 
==== Patched ====
 
'''Yes''' partially on PS5 FWs > 4.50 (need to test). Probably unpatched on FW 4.51 and patched on FW 5.00.
 
== WebKit exploits ==
 
WebKit exploits are harder to make and do not even give arbitrary RW because of PS5 memory protections.
 
=== Modal Browser HTTPS Bypass ===
 
* It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want.
 
=== FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution ===
 
Contrarly to PS4, on PS5 this exploit does not allow arbitrary usermode memory RW because of PS5 memory protections. However thanks to tricks it is possible to get usermode ROP code execution from this exploit.
 
See also [https://www.psdevwiki.com/ps4/Working_Exploits#FW_9.00-9.04_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW].
 
==== Implementations ====
 
* [https://github.com/ChendoChap/PS5-Webkit-Execution Implementation for PS5 by ChendoChap]
 
==== Patched ====
 
'''No''' as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00).
 
==== Tested ====
 
Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00.
 
== Game savedata exploits ==
 
=== PS2 games savedata exploits ===
 
See [https://www.psdevwiki.com/ps4/Working_Exploits#Usermode_Exploits_.28Game_Savedata.29].
 
=== PS4/PS5 PS2emu sandbox escape (mast1c0re) ===
 
See [https://www.psdevwiki.com/ps4/Working_Exploits#PS4.2FPS5_PS2emu_sandbox_escape_.28mast1c0re.29].
 
== PS4 emulator exploits ==
 
Nothing yet.
 
= Kernel =
 
== FW 3.00-4.51 or 5.00 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457) ==
 
See the [https://www.psdevwiki.com/ps4/Working_Exploits#FW_.3C.3D_7.02_-_IPV6_2292PKTOPTIONS_UaF_.28yielding_arbitrary_kernel_R.2FW.29_.28CVE-2020-7457.29 PS4 wiki].
 
=== Exploit Implementation ===
* See also implementation for FreeBSD 9 or 12 or PS4.
* [https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Kernel exploit implementation for PS5 3.00-4.51 by Specter (2022-10-02)]
 
=== Patched ===
'''Yes''' in PS5 FW 5.00 or 5.02. Invulnerable in PS5 FW 2.50 and below.
----
 
== FW <= 4.03 - exFAT driver heap-based buffer overflow ==
 
=== Exploit Implementation ===
Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic.
 
See the [https://www.psdevwiki.com/ps4/Working_Exploits#FW_.3C.3D_9.00_-_exFAT_driver_heap-based_buffer_overflow PS4 wiki].
 
=== Patched ===
'''Yes''' in PS5 FW 4.50.
----
 
== SMAP bypass (CVE-2021-29628) ==
 
See also [https://www.psdevwiki.com/ps4/Working_Exploits#Kernel_SMAP].
 
=== Credits ===
* Discovered and disclosed publicly by m00nbsd. Disclosed to SIE on 2020-12-01.
 
=== Analysis ===
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd]
* [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd]
 
=== Bug Description ===
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.
 
=== Patched ===
'''Yes''' in PS5 FW 2.30 or later according to dates.
----
 
= Secure Kernel =
 
== Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel ==
 
See [https://www.psdevwiki.com/ps4/Bugs_%26_Vulnerabilities#Partial_SAMU_KeyRings_bruteforce_by_missing_HMAC_length_check_in_secure_kernel].
 
Potentially vulnerable on PS5 FWs <= 4.03.
 
= Secure Loader =
 
== Symmetric PS5 root keys dump by software exploit by Fail0verflow ==
 
See [https://twitter.com/fail0verflow/status/1457526453105569793 Fail0verflow's announcement on Twitter (2021-11-08)]
 
Fail0verflow either has a bootrom execution exploit or an AMD/ARM PSP hack.
 
This allows to decrypt on PC most parts of the PS5 System Software files including:
* PUP
* secure loader (?AMD? ARM Platform Security Processor module) of Oberon
And by derivation, mostly like on PS Vita:
* secure modules
* kernel boot loader / BIOS
* non-secure kernel
* usermode system modules
 
Potentially unpatched.
 
= Hardware =
 
Nothing yet.

Latest revision as of 12:45, 12 September 2023

Usermode[edit | edit source]

BD-J exploits[edit | edit source]

FW <=7.61 - BD-JB2 - 0-day vulnerabilities by TheFloW[edit | edit source]

Credits[edit | edit source]

  • TheFloW for the exploits finding.

Implementations[edit | edit source]

Unreleased.

Patched[edit | edit source]

No on PS5 FWs <= 7.61.

FW <=4.51 - BD-JB - Five vulnerabilities chained by TheFloW[edit | edit source]

Credits[edit | edit source]

Implementations[edit | edit source]

Patched[edit | edit source]

Yes partially on PS5 FWs > 4.50 (need to test). Probably unpatched on FW 4.51 and patched on FW 5.00.

WebKit exploits[edit | edit source]

WebKit exploits are harder to make and do not even give arbitrary RW because of PS5 memory protections.

Modal Browser HTTPS Bypass[edit | edit source]

  • It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want.

FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution[edit | edit source]

Contrarly to PS4, on PS5 this exploit does not allow arbitrary usermode memory RW because of PS5 memory protections. However thanks to tricks it is possible to get usermode ROP code execution from this exploit.

See also [1].

Implementations[edit | edit source]

Patched[edit | edit source]

No as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00).

Tested[edit | edit source]

Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00.

Game savedata exploits[edit | edit source]

PS2 games savedata exploits[edit | edit source]

See [2].

PS4/PS5 PS2emu sandbox escape (mast1c0re)[edit | edit source]

See [3].

PS4 emulator exploits[edit | edit source]

Nothing yet.

Kernel[edit | edit source]

FW 3.00-4.51 or 5.00 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457)[edit | edit source]

See the PS4 wiki.

Exploit Implementation[edit | edit source]

Patched[edit | edit source]

Yes in PS5 FW 5.00 or 5.02. Invulnerable in PS5 FW 2.50 and below.

FW <= 4.03 - exFAT driver heap-based buffer overflow[edit | edit source]

Exploit Implementation[edit | edit source]

Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic.

See the PS4 wiki.

Patched[edit | edit source]

Yes in PS5 FW 4.50.

SMAP bypass (CVE-2021-29628)[edit | edit source]

See also [4].

Credits[edit | edit source]

  • Discovered and disclosed publicly by m00nbsd. Disclosed to SIE on 2020-12-01.

Analysis[edit | edit source]

Bug Description[edit | edit source]

A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.

Patched[edit | edit source]

Yes in PS5 FW 2.30 or later according to dates.

Secure Kernel[edit | edit source]

Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel[edit | edit source]

See [5].

Potentially vulnerable on PS5 FWs <= 4.03.

Secure Loader[edit | edit source]

Symmetric PS5 root keys dump by software exploit by Fail0verflow[edit | edit source]

See Fail0verflow's announcement on Twitter (2021-11-08)

Fail0verflow either has a bootrom execution exploit or an AMD/ARM PSP hack.

This allows to decrypt on PC most parts of the PS5 System Software files including:

  • PUP
  • secure loader (?AMD? ARM Platform Security Processor module) of Oberon

And by derivation, mostly like on PS Vita:

  • secure modules
  • kernel boot loader / BIOS
  • non-secure kernel
  • usermode system modules

Potentially unpatched.

Hardware[edit | edit source]

Nothing yet.

Retrieved from "http://www.psdevwiki.com/ps5/index.php?title=Bugs_%26_Vulnerabilities&oldid=2407"