Editing Vulnerabilities

== Hardware Exploits ==

=== PCIe man-in-the-middle attack ===

* First done on 1.01 by failoverflow on PS4 launch !
* Detailed at 33c3: [https://fail0verflow.com/media/33c3-slides/#/5 33c3 slides by Marcan]
* Permits kernel and userland dumping

=== syscon glitching ===
It is possible to glitch the syscon debug interface to allow access and dump keys. Originally done by an anonymous member of fail0verflow.

=== Aeolia/Belize SCA/DPA ===
Aeolia side channel analysis with differential power analysis has been shown to be able to recover key material on all PS4 models. Since Sony never used private/public key pairs, it is possible to exploit this and gain complete control over the southbridge. You can attack the main FreeBSD kernel from here.

== WebKit/Userland Exploits ==

=== FW ?.??-7.55 - WebCore::ValidationMessage::buildBubbleTree() UaF leading to arbitrary RW ===

==== Credits ====
* Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) who are Security Researcher at Synacktiv for fuzzing WebKit, finding a way to exploit the vulnerability on PS4, presenting it on Black Hat Europe 2020 ([https://www.blackhat.com/eu-20/briefings/schedule/index.html#this-is-for-the-pwners--exploiting-a-webkit--day-in-playstation--21212]) and sharing the code (2020-12-10)
* sleirsgoevy for porting (although with low success rate) to 7.00-7.02

==== Analysis ====
* [https://github.com/WebKit/WebKit/commit/b99f0737d0bbcbc52c4b6e6edadcf4990173191f WebKit bad fix commit (2019-05-28)]
* [https://github.com/WebKit/WebKit/commit/b5d5412d9f517e25304aadb1b20dd5118a2c387d WebKit good fix commit (2020-09-11)]
* [https://www.synacktiv.com/publications/this-is-for-the-pwners-exploiting-a-webkit-0-day-in-playstation-4.html Write-up by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)]
* [http://i.blackhat.com/eu-20/Thursday/eu-20-Meffre-This-Is-For-The-Pwners-Exploiting-A-Webkit-0day-In-Playstation4.pdf Presentation slides by by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)]

==== Bug description ====

* The method buildBubbleTree makes a call to update the layout during which all user registered JS handlers are executed. If the ValidationMessage is destroyed in a JS callback, this could lead to a Use-After-Free situation when we get back to buildBubbleTree code.

* ValidationMessage::buildBubbleTree is doing layout which can run a script detaching the owner form element, and this ValidationMessage object can be destroyed.

After private disclose by Synacktiv ethical hackers, the vulnerability was fixed in Webkit on September 11st 2020. SIE updated to the patched WebKit with firmware 8.00 released on October 14st 2020.

==== Exploit Implementation ====
* [https://github.com/synacktiv/PS4-webkit-exploit-6.XX Initial 6.xx implementation by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-11-12]
* [https://github.com/sleirsgoevy/PS4-webkit-exploit-7.02 7.02 implementation with code execution by sleirsgoevy (2020-12-15)]
* [https://github.com/sleirsgoevy/ps4jb 6.72-7.02 Kernel exploit using this webkit exploit by sleirsgoevy (2020-12-16)]
* [https://github.com/ChendoChap/ps4-ipv6-uaf/tree/7.00-7.02 7.00-7.02 Kernel exploit using this webkit exploit by ChendoChap (2020-12-16)]

==== Patched ====
'''Yes''' in 8.00 FW. Tested working on FWs 6.72-7.55.

=== FW 6.00-6.72 - bad_hoist exploit (CVE-2018-4386) leading to arbirary RW ===

==== Credits ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Sep 13, 2018)
* Fire30 for turning the vulnerability into exploit for PS4 (Dec 30, 2019)
* sleirsgoevy for attempting to stabilize the PS4 exploit with a new implementation (Feb 23, 2020)

==== Analysis ====
* https://bugs.chromium.org/p/project-zero/issues/detail?id=1665
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4386
* https://packetstormsecurity.com/files/155871/Sony-Playstation-4-Webkit-Code-Execution.html
* https://twitter.com/Fire30_/status/1211775229116211200

==== Bug Description ====
WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary doesn't invalidate the ForInContext object.

It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated.

This is a Type Confusion exploit.

==== Exploit Implementation ====
* [https://github.com/Fire30/bad_hoist Initial implementation by Fire30]
* [https://github.com/sleirsgoevy/bad_hoist Implementation with code execution by sleirsgoevy]

==== Patched ====
'''Yes''' in 7.00 FW
----

=== FW 6.00-6.20 - JSArray::shiftCountWithArrayStorage() OOB RW (CVE-2018-4441) leading to arbitrary RW ===

==== Credits ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Oct 3, 2018)
* Specter for the rewriting for PS4 (Mar 8, 2019)
* St4rk for helping Specter

==== Analysis ====
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1685 Bug report by Lokihardt (Oct 3, 2018)]
* [https://github.com/WebKit/webkit/commit/51a62eb53815863a1bd2dd946d12f383e8695db0 WebKit fix commit (Oct 15, 2018)]
* [https://mastodon.social/@buherator/101654714198519755 Announce of incoming write-up by rkmylo and buherator/stratan/@5tratan, Meligra Team (Feb 25, 2019)]
* [https://rstforums.com/forum/topic/110439-cve-2018-4441-oob-rw-via-jsarrayunshiftcountwitharraystorage-webkit/ Write-up by Nytro, Meligra Team (Feb 27, 2019)]

==== Bug Description ====
We would take the fast path for JSArray::shiftCountWithArrayStorage when the array hasHoles(). However, the code for this was wrong. It would incorrectly update ArrayStorage::m_numValuesInVector.

==== Exploit Implementation ====
* [https://github.com/Cryptogenic/PS4-6.20-WebKit-Code-Execution-Exploit PS4 6.20 WebKit exploit by Specter]

==== Patched ====
'''Yes''' in 6.50 FW
----

=== FW 6.00-?6.20? - JSC::arrayProtoPrivateFuncConcatMemcpy() Information Leak (CVE-2018-4358) ?leading to ASLR defeat? ===

==== Credits ====
* bkth, niklasb and saelo (from phoenhex Team) for the exploit PoC in Safari (Sep 26, 2018)
* Vultra for discovering that the exploit worked since FW 6.00 (Dec 10, 2018)

==== Analysis ====
* https://github.com/WebKit/webkit/commit/b68b373dcbfbc68682ceeca8292c5c0051472071
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4358
* https://phoenhex.re/2018-09-26/safari-array-concat

==== Bug Description ====

==== Exploit Implementation ====
* [https://github.com/externalist/exploit_playground/blob/master/jsc_ConcatMemcpy_infoleak/ileak.html PoC for iOS]
* [https://github.com/Josephmh97/PS4_jsc_ConcatMemcpy_POC PoC for PS4]

==== Patched ====
'''Yes''' in 6.50/1 FW

==== Tested ====
Works on 6.00-6.20. Not working on PS4 FWs <= 5.56 because JSC (JavaScriptCore) was too old.
----

=== FW 4.50-5.56 - JSGlobalObject::haveABadTime() Type Confusion (CVE-2017-7005) leading to arbitrary RW ===

==== Credits ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Mar 20, 2017)
* ALEXZZZ9 for the first PS4 implementation (on 5.01), and at same time for burning the exploit (Feb 20, 2018)
* qwertyoruiop for rewriting and porting to 5.05 and 5.50

==== Analysis ====
[https://bugs.chromium.org/p/project-zero/issues/detail?id=1208 Project Zer0 Bug Description]

==== Bug Description ====
When JSGlobalObject::haveABadTime() is called with arrays of a different JSGlobalObject type, type confusion can occur, leading to memory corruption.

==== Exploit Implementation ====
* [https://github.com/ALEXZZZ9/PS4-5.01-WebKit-Exploit-PoC]
* [http://crack.bargains/550/ PS4 5.50 (WebKit Only)]
* [https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/master/expl.js]

==== Patched ====
'''Yes''' in 6.00 FW
----

=== FW 5.05 - Document::adoptNode() UaF leading to crash ===

==== Credits ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Jan 23, 2017)
* CelesteBlue for testing on PS4 and PSVita

==== Analysis ====
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1099 exploit report by Lokihardt (Jan 23, 2017)]
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2468 mitre report]
* [https://www.exploit-db.com/exploits/41868 exploitDB report]
* [https://bugs.chromium.org/p/chromium/issues/detail?id=541206 related bug (Oct 8, 2015)]
* Test on PSVita FW 3.60 by CelesteBlue (May 9, 2020)
* Test on PS4 FW 5.05 by CelesteBlue (Aug 20, 2020)

==== Bug Description ====

==== Exploit Implementation ====
* [https://github.com/Metnew/uxss-db/tree/master/webkit/CVE-2017-2468 PoC that just crashes on PS4 FW 5.05]

==== Patched ====
'''Maybe''' in ?6.00? FW.
----

=== FW ?-5.05-? - WebCore::HTMLFrameElementBase::marginHeight() Heap UaF (CVE-2016-1859) leading to crash ===

PoC crashes the webbrowser.

* [http://arayz.github.io/933ky/A-general-attack-model-of-UAF-on-browser/ Writeup by Arayz (Wang Ao) (March 31, 2017)]

=== FW 4.50-5.01 - Element::setAttributeNodeNS() UaF leading to arbitrary RW ===

==== Credits ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Mar 15, 2017)
* qwertyoruiop for the PS4 exploit (October 2017)
* Specter for the writeup (May 27, 2018)

==== Analysis ====
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1187 exploit report by Lokihardt (Mar 15, 2017)]
* [https://twitter.com/VVildCard777/status/919843554964443137 First test on PS4 by WildCard (Oct 16, 2017)]
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/WebKit/setAttributeNodeNS%20UAF%20Write-up.md Specter's setAttributeNodeNS Exploit Writeup]

==== Bug Description ====
By forcing setAttributeInternal() to call setAttributeNodeNS() twice, an attribute node reference will be added twice to the list. When one is free()'d, the second attribute still contains a duplicate stale reference, leading to a use-after-free (UAF) scenario. 

==== Exploit Implementation ====
[https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit PS4 5.05 WebKit + Kernel Exploit]

==== Patched ====
'''Yes''' in 5.03 FW.
----

=== FW 3.15-4.07 - Stack Uninitialized Read UaF leading to arbitrary RW ===

==== Credits ====
* qwertyoruiop for the exploit
* Specter for the writeup

==== Analysis ====
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/4.0x%20WebKit%20Exploit%20Writeup.md Specter's 4.0x WebKit Exploit Writeup]

==== Bug Description ====
Via a specially crafted valueOf() function of an arguments.length() function, non-zero indexes of the stack-allocated array are not initialized, leading to a stack uninitialized read. This can be abused to store a reference that can later be re-obtained post-GC (garbage collection) yielding a use-after-free() (UAF) situation.

==== Exploit Implementation ====
* [https://github.com/Cryptogenic/PS4-4.0x-Code-Execution-PoC Specter's commented and usable version]
* [https://gist.github.com/X41/36acd2a6939e4cebbecba45d35bf0d75 mirrorred expl.js from qwertyoruiop]

==== Patched ====
'''Yes''' in 4.50 FW

==== Tested ====
Works on 3.15-4.07. Not working on <=3.11.
----

=== FW 3.15-3.70 - JSArray::sortCompactedVector() Heap UaF leading to arbitrary RW ===

==== Credits ====
* xyz for the original exploit on PSVita (HENkaku)
* Fire30 for porting to PS4
* Specter for improved PS4 playground

==== Analysis ====
* [https://blog.xyz.is/2016/webkit-360.html PSVita 3.60 HENKaku webkit exploit writeup]

==== Bug Description ====
When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer isn't re-updated nor nulled. When this memory in free()'d, the reference is maintained and thus memory corruption can occur.

==== Exploit Implementation ====
* [https://github.com/henkaku/henkaku/blob/master/webkit/exploit.js PSVita 3.60 webkit exploit by xyz]
* [https://github.com/Fire30/PS4-3.55-Code-Execution-PoC PS4 playground 3.15-3.70 by Fire30]
* [https://github.com/Cryptogenic/PS4-Playground-3.55 Improved PS4 playground 3.15-3.70 by Specter]

==== Patched ====
'''Yes''' in 4.0?0? FW

==== Tested ====
Works on 3.15-3.70. Not working on <= 3.11. Maybe working on 4.00.
----

=== FW <= 3.50 - WebCore::TimerBase::heapPopMin() Heap UaF leading to crash ===

==== Analysis ====
* https://github.com/WebKit/webkit/commit/98845d940e30529098eea7e496af02e14301c704
* https://xz.aliyun.com/t/292

==== Bug Description ====
"As of firmware version 3.55 a patch has been included to prevent a use-after-free segmentation fault from being exploited. This could have led to a ROP chain and code execution. It would have been cool if someone would have done some real research on it..."

==== Exploit Implementation ====
* [http://psxhax.com/threads/ps4-3-50-webkit-exploit-from-playstation-4-dev-qwertyoruiop.450/ Article about qwertyoruiop's tests (20-05-2016)]
* [http://psxhax.com/threads/ps4-heap-use-after-free-at-webcore-3-50-poc-by-hunter128.452/ Article about initial PoC for PS4 (21-05-2016)]
* [http://wololo.net/talk/viewtopic.php?t=45888 Initial PoC for PS4 (21-05-2016)]
* [https://web.archive.org/web/20161030085033/http://cryptoanarchic.me/wat.txt iOS 9.3.2 WebKit RCE via heapPopMin (07-2016)]
* [https://twitter.com/qwertyoruiopz/status/756268361282125824 qwertyoruiop's tweet (22-07-2016)]
* [https://github.com/Jailbreaks/jbme/tree/master mirror of iOS 9.3.2 WebKit RCE via heapPopMin]

==== Patched ====
'''Yes''' in 3.55 FW

==== Tested ====
Works on 3.15, 3.50 FW.
----

=== FW <= 2.03 - WebCore::CSSSelector Heap Overflow (CVE-2014-1303) leading to arbitrary RW ===

==== Credits ====
* KeenTeam for finding and documenting the bug
* Liang Chen from KeenTeam for the writeups
* xyz for porting to PSVita FWs 3.30-3.36
* Fire30 for porting to PS4
* dreadlyei (unknown person, credited by Fire30)

==== Analysis ====
* [https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not.PDF BlackHat EU 2014 'WebKit Everywhere - Secure Or Not?' slides]
* [https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not-WP.pdf BlackHat EU 2014 'WebKit Everywhere - Secure Or Not?' PDF]
* [https://cansecwest.com/slides/2015/Liang_CanSecWest2015.pdf Attacking WebKit Applications by exploiting memory corruption bugs by Liang Chen]

==== Bug Description ====
By forcing addRule() to be called on a CSS Selector via window.getMatchedCSSRules(), a 1-bit OOB write can be achieved and leveraged to corrupt heap memory.

==== Exploit Implementation ====
* [https://github.com/Fire30/PS4-2014-1303-POC ROP PoC for PS4 FW 2.03 by Fire30]
* [http://wololo.net/2016/04/21/proof-of-concept-webkit-exploit-running-on-ps4-firmwares-up wololo article]
* WebKit exploit for 3.30-3.36 FW PSVita by xyz: used in vitasploit
* [https://github.com/RKX1209/CVE-2014-1303 PoC for Linux by RKX1209]

==== Patched ====
'''Yes''' in 2.50 FW

==== Tested ====
* Working on 2.03 FW. Might work on 2.04 (99% sure as 2.04 PUP is about same size as 2.03 PUP).
----

=== FW <= 2.03-? - WebCore::ImageInputType::attach Heap UaF (CVE-2013-2857) leading to ROP execution ===

==== Credits ====
* Chromium bugs reporters
* JumpCallPop, jam1garner, hedgeberg for inital exploit on Wii U
* yellows8 for ROP on Wii U
* orboditilt for increasing stability on Wii U
* zoogie for porting Wii U exploit to New3DS
* CelesteBlue for testing on PS4 FW 2.03

==== Analysis ====
* [https://bugs.chromium.org/p/chromium/issues/detail?id=240124 Chromium bug report with a PoC]

==== Bug Description ====
Use-after-free with input type image. Error event was fired synchronously blowing away the input element from underneath.

Exploiting this vulnerability on PS4 is not good because:
* This vulnerability does not provide arbitrary RW without code execution, hence ROP chain (at least to stack pivot to JiT code) must be made with a memory dump or decrypted modules for this FW gotten using another vulnerability.
* There is userland ASLR since about FW 1.70 so ROP chain gadgets must be relocated at runtime. This means another vulnerability allowing userland arbitrary read is needed.
* As usually an arbitrary read vulnerability also gives arbitrary write, and as arbitrary RW leads to userland code execution (by hijacking JS pointers in virtual table), this UaF is not needed at all.
* Even if we get ROP chain to work on PS4 with this UaF vulnerability, there is no evidence that a return to JavaScript from ROP chain is doable, making this exploit less convenient than arbitrary RW exploits method of getting code execution then returning to userland by restoring vtable.

==== Exploit Implementation ====
* [https://github.com/WiiUTest/JsTypeHax Initial Wii U implementation]
* [https://github.com/WiiUTest/JsTypeHax/blob/master/payload/exploit_WORKING.html Wii U stabler implementation (last update May 22, 2018)]
* [https://github.com/wiiu-env/JsTypeHax Wii U tabler implementation (last update Jan 13, 2019)]
* [https://github.com/Hiperhazz/wiiuexploit/blob/master/firmware/Exploit.html Wii U stabler implementation by Hiperhazz (last update May 26, 2020)]
* [https://github.com/zoogie/new-browserhax/blob/master/index.html New3DS implementation by zoogie (last update Aug 9, 2020)]

==== Patched ====
'''Yes''' in ? FW

==== Tested ====
* Working on 2.03 FW. Might work on 2.04 (99% sure as 2.04 PUP is about same size as 2.03 PUP).
----

=== FW <= 1.76 - JSArray::sort() Heap Overflow (CVE-2012-3748, PSA 2013-0903-1) leading to arbitrary RW ===

==== Credits ====

* Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013)
* nas and Proxima for the first PS4 POC on 1.76 PS4 (Oct. 23, 2014)
* sony for patching the exploit in FW 2.00 (Oct 27, 2014)
* CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849]

==== Analysis ====
* [https://packetstormsecurity.com/files/cve/CVE-2012-3748 CVE-2012-3748]
* [https://packetstormsecurity.com/files/123088/ PSA 2013-0903-1]
* [https://www.exploit-db.com/exploits/28081/ Exploit PoC by Vitaliy Toropov]

==== Bug Description ====
By forcing the compare function to reduce the size of the array, trailing items will be written out of bounds (OOB write), leading to heap memory corruption.

==== Exploit Implementation ====
* [http://wololo.net/talk/viewtopic.php?p=368577 first POC for 1.76 PS4 by nas and Proxima]
* [http://wololo.net/downloads/index.php/download/8230 mirror]
* [http://daxhordes.org/ps4_176/ps4_dump.html live test]
* [http://daxhordes.org/ps4_176/ps4_dump2.html livetest2]
* [http://daxhordes.org/ps4_176/ps4_rop2.html ROP2]
* [https://cturt.github.io/PS4-playground/ PS4 playground 1.76 by CTurt]
* [https://bitbucket.org/DaveeFTW/psvita-260-webkit/src/master/ PSVita 2.00-3.20 webkit exploit]

==== Patched ====
'''Yes''' in 2.00 FW

==== Tested ====
* Working on 1.01-1.76 FW.

== Userland securities ==

=== Userland ASLR ===

* Very old firmwares (<= 1.05) don't have ASLR enabled, but it was introduced sometime before firmware 1.70. "Address Space Layout Randomization" (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4.
* To defeat userland ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address.

=== Module imports table cleaned before execution ===

* Between 1.76 and 4.05, Sony did that to prevent webkit exploiters from defeating userland ASLR easily.
* Now we have to dump entire userland sandboxed memory, and by studying it we can defeat ASLR:
1. Chose a function (ex: __stack_chk_fail) imported from LibKernel by SceWebkit2
2. Read pointer contained at the address where the call is done
3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module
4. This result is LibKernel base address. This method works for any imported module.

=== DEP / NX ===
* "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to userland memory then executing it.
* 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs).

=== JiT removed from webbrowser ===
* On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched.
* Workaround is to use ROP.

=== Syscalls removed ===

=== Syscall 0 disabled i.e Error Kernel: The application directly issues a syscall instruction (24) ===

* Between 2.00 and 2.57, SCE has removed system call 0, so we can no longer call any syscall we want by specifying the call number in the rax register.
* Doing so now crashes the app and gives error CE-34878-0, SCE_KERNEL_ABORT_REASON_SYSTEM_ILLEGAL_FUNCTION_CALL, with the message "Kernel: The application directly issues a syscall instruction (24)".
* We now have to use wrappers provided to us from the libkernel / libkernel_web / libkernel_sys modules to access system calls.

=== bpf_write function stripped out of the kernel ===

* On 4.70, bpfwrite() was stripped out of the kernel entirely to patch kernel vulnerability exploited in 4.55 kexploit.

=== bpf_open function blocked for unprivileged processes ===
* On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF.

=== bpf_ioctl function blocked or removed ===
* Moreover, on FW 5.50+, opening BPF is still possible in less sandboxed apps like test/devkits fselfs. But this is useless because ioctl doesn't work.

=== Device access blocked/removed from webbrowser ===

* Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from webbrowser

== Kernel Exploits ==

=== FW <= 7.02 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) ===

==== Credits ====
* 2018-08-18 up to 2020-07-06 Fire30 for finding and keeping the vulnerability as a private 0day for it not to be patched by SIE. [https://twitter.com/Fire30_/status/1280228173888831490]
* 2020-07-06 TheFloW for publishing publicly a PoC leading to code execution on FreeBSD. [https://twitter.com/theflow0/status/1280224554393178122]
* sleirsgoevy and ChendoChap for porting the PoC to PS4 and chaining it with the 6.72 and 7.02 webkit exploits.

==== Analysis ====
* [https://hackerone.com/reports/826026 TheFloW's report of the exploit with a FreeBSD 9-12 PoC]

==== Bug Description ====
Due to missing locks in option IPV6_2292PKTOPTIONS of setsockopt, it is possible to race and free the struct ip6_pktopts buffer, while it is being handled by ip6_setpktopt. This structure contains pointers (ip6po_pktinfo) that can be hijacked to obtain arbitrary kernel R/W primitives. As a consequence, it is easy to have kernel code execution. This vulnerability is reachable from WebKit sandbox and is available in the latest FW, that is 7.02.

==== Exploit Implementation ====
* [https://hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com/Y13EyQCGKEqxH8PpJgFKh5uY?response-content-disposition=attachment%3B%20filename%3D%22exploit.c%22%3B%20filename%2A%3DUTF-8%27%27exploit.c&response-content-type=text%2Fx-c%2B%2Bsrc&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAQGK6FURQ4G43T3HL%2F20200719%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20200719T222620Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEGUaCXVzLXdlc3QtMiJHMEUCIQD%2F0c09Z1wbdZi9kMJukdNUryexRJUKWxTiqcoAnsxE1gIgQqef8QiWKjHnPYTPLZO5P1KcXixsUrL2Z8AnnT404jEqtAMIHRABGgwwMTM2MTkyNzQ4NDkiDGkLHbTp2BRWlnoy5iqRA0gx69uKt57lUwOOB48RT1j6IEwp5FGjfVUviEc78dJ99qZaUUB%2FI%2BfRDN5J7OKceSsOZwZ1VebLhz2za2R2c5gjX9EtCWf%2Brl6EIvxMXSyC%2FYxnbAVAXvB8jf5sRWr%2FgqpUQbNr1V5JFbe6IYw%2FvlmiYqMzhSqBpupfI6E6cwa3luTr0GBWKR4lppzFXR7%2B6e9bUAC%2BQiQcPk%2FzNqKAGE%2FFKkDreC1Vvlct%2FvhqQ0HbaNesEQG%2F0qbv2%2B6UB9iU4n4uk369G%2BmwtnfEh0%2BEeptwYVwFApNIfwRdOXx%2FrPnL69fkuxjA8BKQpILIf2XYxrbtlE8Nth8z75cXxlFLgdfmhyidy2Q0wkjS45tx39ROJZQBC9g%2Fstx7u0jFZ1M3MJuBVJc%2FO5aWCPOBoZrQKpbAJqHSqF5x5ON3x%2BNkFbfMj%2B20qSfmBn7eT2FYBPR3bahKnI5lZeDzYAQgSIvUpAGW%2Fi2UL1ZmEqEKoV%2Fh67YYzCMzM3uUqPRuSGIeQsmUEQeY%2BjR7PPoR71928%2B%2FHFBbTMN%2FW0vgFOusB5oRuVzVviKnOLIHgixiK0h5rYZe5TfP3JtYhhy3XpV0RB3BliMzTvuhn5TevB9ZZlRYKnP7x08C888AIsUKSm3UuQpHmnZ1M5yeypI5MwjmLO51lBnQwigz0tHGDu2jlOLyvW9bXzFw1rNLSfM5x6dWmvMdYyTkStTFnwcN0V14U5EOVzdfo9WYogPfzq%2FEeOopTjDAusDtIBEtn4ILZxnlPxi8oLY8rI03lsF4GmRx6zQKJ%2Bzs44lQi5DRSMOueKTvWmPRaR83hUAIxlXdDCdM8wPYQe0eMl3V3macYTRK1FghrvW4BCo6ZqQ%3D%3D&X-Amz-Signature=2862cc641fee752f041d00f7d021826e09354ef202bb2da78a966e5b90830662 TheFloW's PoC for FreeBSD 9 and 12]
* [https://github.com/sleirsgoevy/ps4jb PS4 6.72-7.02 WebKit + Kernel Exploit implementation by sleirsgoevy]
* [https://github.com/ChendoChap/ps4-ipv6-uaf PS4 5.05-7.02 WebKit + Kernel Exploit implementation by ChendoChap]

==== Patched ====
'''Yes''' in 7.50 FW
----

=== FW <= 5.07 - BPF Race Condition (Yielding Double Free()) ===

==== Analysis ====
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%205.05%20BPF%20Double%20Free%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 5.05 BPF Race Condition]

==== Bug Description ====
Due to improper locking, two threads can enter the BPF SETWF ioctl command handler. While the bug is similar to that of 4.55, the method of attack is slightly different. Since write() was removed for BPF in 4.70, instead of triggering a use-after-free with write() - SETWF is ran in parallel via threading. Eventually, both calls will copy the same pointer to the stack, leading to both threads free()'ing the same pointer, poisoning the freelist. This can later be leveraged via heap spraying to corrupt heap memory to obtain arbitrary code execution in supervisor mode (ring0).

==== Exploit Implementation ====
* [http://crack.bargains/505k/ PS4 5.05 WebKit + Kernel Exploit]
* [https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit PS4 5.05 WebKit + Kernel Exploit Source]

==== Patched ====
'''Yes''' in 5.50 FW
----

=== FW <= 4.55 - BPF Race Condition (Yielding UaF) ===

==== Analysis ====
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 4.55 BPF Race Condition]

==== Bug Description ====
Due to improper locking, two threads can enter the BPF ioctl command handlers for setting a new write filter (SETWF) and setting a filter (SETIF). Both threads will reference the same pointer. In specially crafted situations, one thread could free() this pointer while the other thread executes it as a filter post-validation. This allows an unprivileged user to obtain an out-of-bounds (OOB) write on the stack, leading to arbitrary code execution in supervisor mode (ring0).

==== Exploit Implementation ====
[http://crack.bargains/455/ PS4 4.55 WebKit + Kernel Exploit]<br/>
[https://github.com/Cryptogenic/PS4-4.55-Kernel-Exploit PS4 4.55 WebKit + Kernel Exploit Source]

==== Patched ====
'''Yes''' in 4.70 FW
----

=== FW <= 6.00 ?6.02? - sys_getcontext Information Leak (kASLR defeat) ===

==== Analysis ====
* https://www.cvedetails.com/cve/CVE-2018-17155/
* coming soon by CelesteBlue

==== Bug Description ====
System call 421 or sys_getcontext() initializes the structure pointed at by ucp to the currently active context. The vulnerability is, some areas of memory copied out are not initialized, and thus the function leaks memory at certain spots. This vector was patched in 6.20, as now before the buffer is used it is initialized to 0 via bzero().

==== Exploit Implementation ====
* QuickHEN by CelesteBlue (v2 not released yet)
* KitHEN by CelesteBlue (not released yet)

==== Patched ====
'''Yes''' somewhere between 6.00 and 6.20 FW
----

=== FW <= 4.07 - sys_thr_get_ucontext Information Leak (kASLR defeat) ===

==== Analysis ====
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md#vector-sys_thr_get_ucontext Specter's Writeup]

==== Bug Description ====
System call 634 or sys_thr_get_ucontext() allows to obtain information on a given thread. The vulnerability is, some areas of memory copied out are not initialized, and thus the function leaks memory at certain spots. This vector was patched in 4.50, as now before the buffer is used it is initialized to 0 via bzero().

==== Exploit Implementation ====
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]

==== Patched ====
'''Yes''' in 4.50 FW
----

=== FW <= 4.05 - NamedObj Type Confusion (Yielding UaF) ===

==== Credits ====
* Chaitlin Tech for having been the first to show they had pwned PS4 FW 4.01 at Geekpwn convention. (2016-10-24)
[https://www.youtube.com/watch?v=KLkKql31d44 official video], [https://twitter.com/ChaitinTech/status/790945929624948736 tweet 1], [https://twitter.com/ChaitinTech/status/790947840495267841 tweet 2], [https://twitter.com/ChaitinTech/status/790949072429428737 tweet 3] (2016-10-25)
* fail0verflow for the first writeup (2017-10-19)
* Specter for rewriting the exploit using a different object, and releasing it publicly (2017-12-27)

==== Analysis ====
* [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the 1.01-4.05 namedobj kernel exploit] (2017-10-19)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his 4.05 implementation] (2017-12-28)

==== Bug Description ====
Type confusion in the namedobj system once exploited can lead to an arbitrary free() allowing an attacker to craft a use-after-free() (UAF) situation to corrupt kernel memory. This can be leveraged to eventually obtain an arbitrary code execution primitive in supervisor mode (ring0).

==== Exploit Implementation ====
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]

==== Patched ====
'''Yes''' in 4.06 FW

==== Tested ====
Works on FWs 4.00-4.05. On <=3.70 FW we haven't found a way to leak the target object, but it might be doable as F0F did it on 1.01.
----

=== FW <= 1.76 - dlclose Kernel Heap Overflow ===

* Discovered by CTurt. Privately implemented thanks to qwertyoruiop. CTurt published a writeup then the exploit was publicly implemented by kR105 and on another side by Zer0xFF and Bigboss (psxdev).

==== Analysis ====
[http://cturt.github.io/dlclose-overflow.html Analysis of sys_dynlib_prepare_dlclose PS4 kernel heap overflow (by CTurt with the help of qwertyoruiop)]

==== Bug Description ====
Integer overflow in the sys_dynlib_prepare_dlclose() system call can lead to a heap overflow causing memory corruption, allowing an attacker to obtain code execution in supervisor mode (ring0).

==== Exploit Implementation ====
[https://github.com/kR105/PS4-dlclose Public release by kR105]

==== Patched ====
'''Yes''' in 2.00 FW
----

=== FW <= 1.76 - BadIRET ===

==== Analysis ====
* Ported from FreeBSD 9 to PS4 by CTurt.

[http://cturt.github.io/ps4-3.html Hacking the PS4, part 3 - Kernel exploitation (by '''CTurt''')]<br/>
[https://nvd.nist.gov/vuln/detail/CVE-2014-9322 NVD Bug Description]

==== Bug Description ====
Faults associated with the stack segment (SS) register are not handled properly, allowing unprivileged users to trigger an IRET instruction that accesses a GS Base from userland memory, providing an attacker with a method of privilege escalation.

==== Source ====
[http://seclists.org/oss-sec/2015/q3/66 CVE-2014-9322]
<br/>[http://www.filedropper.com/ps4-bad-iret-5fs Public binary]

==== Patched ====
'''Yes''' in 2.00 FW

==== Implementation ====
[https://mega.nz/#!Fo1xFDrb!EuOl5s6g_IPTtI6dAknSKYJZ8YLzZWvx1MPUPmkr3Sg (mirror)]

== Kernel securities ==

=== Kernel ASLR ===
* Since 3.50 FW, ASLR (Address Space Layout Randomization) has been enabled in PS4 kernel.
* This means that to properly exploit the kernel to escalate privileges, an information disclosure vulnerability will most likely be needed to defeat ASLR and locate the kernel in memory.

=== Kernel SMAP ===
* In 5.0x FW and above, "Supervisor Mode Access Prevention" (SMAP), a new custom mitigation was added to the kernel to prevent exploiters from pivoting the kernel stack pointer into userland memory (attempting to do so would crash the system).
* A new exploitation strategy is needed to run kernel ROP chains, such as qwertyoruiop method used in the 5.05 BPF kernel exploit:<br />
We need to get our ROP chain into kernel memory. To do this, qwertyoruiop decided to go with the method he used on the iPhone 7 - essentially using JOP to push a bunch of stack frames onto the kernel stack, and memcpy()'ing the chain into RSP.


{{Reverse Engineering}}
<noinclude>[[Category:Main]]</noinclude>