Editing Bugs & Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1: Line 1:
== Unknown / unpatched ==
Ps3 save data exploit


=== WebKit parseFloat() type confusion leading to stack buffer overflow ===
Unsigned codencan be added to the sfo coz the console doesnt recognize special characters


==== Credits ====
http://www.exploit-db.com/exploits/25718/
* Zuk Avraham
Firmwware target 4.31
* TODO
Working on 4.31


==== Bug Description ====
When inserting NaN with a parameter as an argument into parseFloat(), we can overflow the tiny buffer created by parseFloat().
==== Analysis ====
* [https://web.archive.org/web/20210521110132/https://playstationhax.xyz/forums/topic/2807-release-full-rsx-vramio-access-exploit/?tab=comments#comment-28458 WebKit PoC for PS3 released by xerpi through zecoxao in Playstationhax.xyz forum (2016-03-24)]
==== Implementation ====
* [https://github.com/PS3Xploit/PS3HEN PS3HEN on PS3 by the PS3Xploit team]
* [https://imthezuk.blogspot.com/2010/11/float-parsing-use-after-free.html Writeup and PoC on Android 2.1 by Zuk Avraham]
==== Patched ====
Patched on PS3 FW 4.83. Remains exploitable on higher firmwares by installing old WebKit sprx files in hybrid PUP.
=== WebKit CSS font face source type confusion leading to read primitive ===
==== Credits ====
TODO
==== Bug Description ====
While parsing the source of a CSS font face, CSSParser::parseFontFaceSrc() assumes the value given is a string, but if we insert a specific double value into an exploitable function like insert() or format(), we can leak the memory via an overlap between two variables.
==== Implementation ====
* [https://github.com/PS3Xploit/PS3HEN PS3HEN on PS3 by the PS3Xploit team]
* [https://code.google.com/p/chromium/issues/detail?id=63866] initial bug report
==== Patched ====
Patched on PS3 FW 4.83. Remains exploitable on higher firmwares by installing old WebKit sprx files in hybrid PUP.
=== RSX VRAM Access ===
* [https://web.archive.org/web/*/http://playstationhax.xyz/forums/topic/2807-release-full-rsx-vramio-access-exploit/?do=findComment&comment=28421]
==== Patched ====
Not Patched.
=== Memory corruption and NULL pointer in Unreal Tournament III 1.2 ===
* [http://cxsecurity.com/issue/WLB-2008070060]
Unsure if it applies to PS3.
=== MacOS X 10.5/10.6 libc/strtod(3) buffer overflow ===
* [http://cxsecurity.com/issue/WLB-2010010162]
Unsure if it applies to PS3.
=== OpenPrinter() stack-based buffer overflow ===
* [http://seclists.org/fulldisclosure/2007/Jan/474]
==== Patched ====
?patched?
=== DOM flaw ===
http://seclists.org/fulldisclosure/2009/Jul/299
==== Patched ====
?patched?
=== PS3Xploit Kernel Exploit ===
==== Credits ====
* Team PS3Xploit
* TODO
==== Bug description ====
To be disclosed.
==== Implementation ====
* [https://github.com/PS3Xploit/PS3HEN PS3HEN on PS3 by the PS3Xploit team]
==== Patched ====
Not patched as of PS3 FW 4.90.
=== Leakage of PTCH body plaintext over SPI on all BGA SYSCONs ===
When reading the body via the EEPROM read command, in all cases, the MISO of the SPI will leak the plaintext of the PTCH body to someone who might be interacting with the EEPROM interface. Note that this ONLY happens when SC interacts with patch body and some specific areas.
==== Examples ====
===== MISO =====
<pre>
04 C8 34 30 BD E4 9F 27 16 DE 5C C1 E7 A3 DA 9C
7F 5B 29 9A 5A 48 5C 14 ED B2 DE 28 84 43 68 82
98 87 4E D4 62 51 01 A9 24 34 02 B3 FF 26 63 17
77 8E 95 56 B1 5F 9F 22 93 46 DE 4E 3A 5E 8A D3
</pre>
===== MOSI =====
<pre>
3C 3A 04 3F 25 A6 68 09 02 00 04 00 00 00 00 00 (0x26B0)
3C 3A 04 3F 71 AD 00 00 09 00 00 00 00 00 00 00 (0x26C0)
3C 3A 04 3F 8E D5 75 0D 00 00 00 00 00 00 00 00 (0x26D0)
3C 3A 04 3F 80 86 48 0B 0B 00 03 00 00 00 00 00 (0x26E0)
</pre>
== Patched ==
=== Lv2 sys_fs_mount stack overflow ===
Stack buffer overflow with required privileges when passing a length greater than 10. It now checks for length less than or equal to 10. If larger than 10, the length gets set to 10.<br>
* [https://nwert.wordpress.com/2012/09/19/exploiting-lv2/ writeup]
* [https://web.archive.org/web/20141201184718/http://pastie.org/4755699 code]
Patched: sometime before [[4.40_CEX|4.40]] (only fw I checked)
=== RSX Syscall bug ===
In most syscalls sony reduces a pointer to 32 bits and would use a special function to write to that pointer.<br> however, in certain rsx syscalls, sony forgot about it, allowing the attacker to write to any part of lv2 memory.
Patched: [[4.40_CEX|4.40]]
=== Lv2 sys_prx_register_module stack overflow ===
Stack buffer overflow which is fixed around 4.3x or 4.4x. Does not require any privileges.
=== Lv2 578 Syscall stack overflow ===
Stack buffer overflow which is fixed around 4.3x or 4.4x. Requires root privileges. Syscall is compiled with stack cookies.
Patched: [[4.4x_CEX|4.4x]]
=== AES CTR vulnerability on SELFs (and ebootroms maybe?) ===
Sometimes SCE reused the same AES CTR keys and IVs in different [[Certified File|Certified Files]].
See also [http://crypto.stackexchange.com/questions/14628/why-do-we-use-xts-over-ctr-for-disk-encryption].
See also [https://wiki.henkaku.xyz/vita/Vulnerabilities#AES_CTR_IV_reused_in_some_Certified_Files].
Patched: since some PS Vita prototype FWs as their [[Certified File|Certified Files]] started having always different IVs.
Maybe not patched on PS3 ebootroms.
=== PARAM.SFO stack-based buffer overflow ===
* [http://seclists.org/fulldisclosure/2013/May/113]
Patched: since 2012-05-01 ([[4.40_CEX|4.40]] and later)
==== Proof of Concept ====
Unsigned code can be added to the [[PARAM.SFO]] because the console does not recognize special characters.
* [http://www.exploit-db.com/exploits/25718/]
Working on [[4.31_CEX|4.31]]. Patched: since 2012-05-01 ([[4.40_CEX|4.40]] and later).
   
   
PoC: PARAM.SFO
PoC: PARAM.SFO
<pre>
PSF�� Ä @� � � � � � ��� � � � ��� � � � ��h � � % � � � �� , � � � �� 4
PSF�� Ä   @� �     � �   �       � ���   �   �   � ���   �   �   � ��h   � �   % � �   � �� , � �   �   �� 4 ���   �  
��� �
$� C ���   @   (� V ���   �   h� j ��
$� C ��� @ (� V ��� � h� j ��
  €  p� t ���   €  ð� 
&#8364; p� t ��� &#8364; &#240;�
ACCOUNT_ID ATTRIBUTE CATEGORY DETAIL PARAMS PARAMS2 PARENTAL_LEVEL SAVEDATA_DIRECTORY SAVEDATA_LIST_PARAM SUB_TITLE TITLE  
ACCOUNT_ID ATTRIBUTE CATEGORY DETAIL PARAMS PARAMS2 PARENTAL_LEVEL SAVEDATA_DIRECTORY SAVEDATA_LIST_PARAM SUB_TITLE
40ac78551a88fdc  
TITLE
SD
40ac78551a88fdc
SD
PSHACK: Benjamin Ninja H%20'>"<[PERSISTENT INJECTED SYSTEM COMMAND OR CODE!]
PSHACK: Benjamin Ninja H%20'>"<[PERSISTENT INJECTED SYSTEM COMMAND OR CODE!]
 
Hackizeit: 1:33:07
Hackizeit: 1:33:07
 
ExpSkills: VL-LAB-TRAINING
ExpSkills: VL-LAB-TRAINING
 
Operation: 1%
Operation: 1%
Trojaners: 0%
Trojaners: 0%
... &#213;&#245;~\&#732;&#242;íA×éú�;óç� 40ac78551a88fdc
... Õõ~\˜òíA×éú�;óç�   40ac78551a88fdc
...
...
BLES00371-NARUTO_STORM-0
BLES00371-NARUTO_STORM-0
HACKINGBKM 1
HACKINGBKM 1
PSHACK: Benjamin Ninja H%20'>"<[PERSISTENT INJECTED SYSTEM COMMAND OR CODE!];
PSHACK: Benjamin Ninja H%20'>"<[PERSISTENT INJECTED SYSTEM COMMAND OR CODE!];
</pre>
 
=== AVP patch bypass exploit ===
 
Patched: since [[3.70_CEX|3.70]] and later.
 
=== PSN security intrusion ===
 
Patched: since [[3.61_CEX|3.61]] enforced password change
 
=== Sony PSN Account Service - Password Reset Vulnerability ===
 
* [http://www.vulnerability-lab.com/get_content.php?id=740]
 
Patched: since 2012-05-01
 
=== ECDSA private key non-random fail ===
 
See fail0verfl0w talk.
 
Patched: since [[3.56-1 CEX|3.56]]
 
=== JIG downgrade ===
 
Patched: since [[3.56-1 CEX|3.56]]
 
=== USB config heap-based buffer overflow (PSjailbreak/PSGroove) ===
 
Patched: since [[3.42_CEX|3.42]] and later
 
=== Leap year bug ===
 
Patched: since [[3.40_CEX|3.40]] and later
 
=== MP4 vulnerability ===
 
Patched: since [[3.21_CEX|3.21]] and later
 
=== Playback of Cinavia DRM protected titles ===
 
Patched: since [[3.10_CEX|3.10]] and later
 
=== Open Remote Play ===
 
Patched: since [[2.80_CEX|2.80]] and later
 
=== BD-J homebrew ===
 
Patched: since [[2.50_CEX|2.50]] and later
 
=== System Software Downgrade with hardware flasher ===
 
See also: [[Downgrading with Hardware flasher]].
 
Patched: since [[2.20_CEX|2.20]] and later (by adding [[CoreOS]] hashing in [[Syscon Hardware|Syscon]] to be checked by [[Hypervisor Reverse Engineering|hypervisor]]; worked around by patching hypervisor on [[3.56-1 CEX|3.56]] and lower capable consoles).
 
=== Full RSX access in OtherOS ===


Patched: since [[2.10_CEX|2.10]] and later
"rsx syscall bug" - in most syscalls sony reduces a pointer to 32 bits and would use a special function to write to that pointer.<br> however, in certain rsx syscalls, sony forgot about it, allowing the attacker to write to any part of lv2 memory.


=== Web browser DoS via a large integer value for the length property of a Select object ===
patched: 4.45


* [http://www.cvedetails.com/cve/CVE-2009-2541/]
http://crypto.stackexchange.com/questions/14628/why-do-we-use-xts-over-ctr-for-disk-encryption CTR bugs on SELFs (and ebootroms maybe?)


Patched: since 4 sept 2009
patched: since Vita pre-retail 0.9.9.6 (SELFs, should match with ps3 firmware at release date), unknown (ebootroms)


=== Remote Play UDP packets DoS ===
http://cxsecurity.com/issue/WLB-2007030183 "Remote Play" Remote DoS Exploit<br />
patched: ?


* [http://www.cvedetails.com/cve/CVE-2007-1728/ / http://cxsecurity.com/issue/WLB-2007030183]
http://cxsecurity.com/issue/WLB-2008070060 Memory corruption and NULL pointer in Unreal Tournament III 1.2<br />
unsure if applies to PS3?


Affected: [[1.60_CEX|2.10]] and PSP 3.10 OE-A
http://cxsecurity.com/issue/WLB-2010010162 MacOS X 10.5/10.6 libc/strtod(3) buffer overflow<br />
unsure if applies to PS3?


Patched: since 13 nov 2008
http://seclists.org/fulldisclosure/2007/Jan/474 OpenPrinter() stack-based buffer overflow<br />
patched: ?


=== Resistance: Fall of Man network update exploit ===
http://seclists.org/fulldisclosure/2009/Jul/299 DOM flaw<br />
patched: ?


Patched
http://seclists.org/fulldisclosure/2013/May/113 PARAM.SFO stack-based buffer overflow<br />
patched: since 2012-05-01 (4.40 and later)


=== Warhawk network update exploit ===
AVP patch bypass exploit<br />
patched: since 3.70 and later


Patched
PSN security intrusion
patched: since 3.61 enforced password change<br />


=== Game Bugs patched via Firmware ===
http://www.vulnerability-lab.com/get_content.php?id=740 Sony PSN Account Service - Password Reset Vulnerability<br />
patched: since 2012-05-01


==== Afro Samurai Black Screen ====
Private key nonrandom fail<br />
patched: since 3.56


Black screen as a failed attempt to call:
JIG downgrade<br />
cellAudioOutConfigure
patched: since 3.56
cellSysutilAvconfExt_FA611DF4


Occours in [[3.01_CEX|Firmware 3.01]]
USB config stack-based buffer overflow (PSjailbreak/PSGroove)<br />
BLUS30264
patched: since 3.42 and later
NPUB90215
BLES00516


In order to correct this problem start up your Playstation 3 system and while on the XMB (Cross Media Bar/System Menu)
Lead year bug<br />
go to "Settings" and select "Sound Settings" from here select "Audio Multi-Output" and set this option to "OFF".
patched: since 3.40 and later
You should be able to play the Afro Samurai Demo or update the retail game properly to the latest patch after this.


Source: [http://support.bandainamcogames.com/index.php?/Knowledgebase/Article/View/216/233/afro-samurai-why-doesnt-my-game-start-up-ps3-only]
MP4 vulnerability<br />
patched: since 3.21 and later


Patched: in ([[VSH]]) since (unknown)
Playback of Cinavia DRM protected titles<br />
patched: since 3.10 and later


== It is not a bug! It is a scekrit feature! ==
Open Remote Play<br />
patched: since 2.80 and later


=== Renesas verify function works on 4 byte values in All renesas/nec SysCon chips ===
BD-J homebrew<br />
patched: since 2.50 and later


All NEC/Renesas syscon chips have their verify function working for a 4 byte array but 256 byte size, increasing the probability of finding the correct bytes as opposed to the intended 256 bytes.
[[Downgrading with Hardware flasher]]<br />
patched: since 2.20 and later (by adding [[CoreOS]] hashing in [[Syscon Hardware|Syscon]] to be checked by [[Hypervisor Reverse Engineering|hypervisor]]; worked around by patching hypervisor on 3.56 and lower capable consoles)


=== (Universal) Renesas checksum function works on 256 byte values (ALL SYSCON CHIPS, stock, PSP, PS Vita, PS3, PS4) ===
Full RSX access in OtherOS<br />
patched: since 2.10 and later


Renesas checksum feature works on 256 byte values instead of the intended block size, which means glitching could be done in a narrower margin, making the efforts a lot easier. it is also possible to identify 256 byte constants contiguous to each other by their checksums.


{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>
Please note that all contributions to PS3 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS3 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps3/Bugs_%26_Vulnerabilities"