Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
== Hardware Exploits == | == Hardware Exploits == | ||
Line 98: | Line 29: | ||
* [https://recon.cx/2018/brussels/resources/slides/RECON-BRX-2018-Mess-with-the-best-die-like-the-rest_(mode).pdf Slides of REcon Brussels 2018 by Volodymyr Pikhur] | * [https://recon.cx/2018/brussels/resources/slides/RECON-BRX-2018-Mess-with-the-best-die-like-the-rest_(mode).pdf Slides of REcon Brussels 2018 by Volodymyr Pikhur] | ||
* [https://www.psxhax.com/threads/ps4-southbridge-reverse-engineered-code-examination-by-jogolden.6736/ jogolden's writeup] | * [https://www.psxhax.com/threads/ps4-southbridge-reverse-engineered-code-examination-by-jogolden.6736/ jogolden's writeup] | ||
== Usermode Exploits (BD-J) == | == Usermode Exploits (BD-J) == | ||
=== FW <=9.00 - Five vulnerabilities by TheFloW === | |||
=== FW <= 9.00 | |||
==== Credits ==== | ==== Credits ==== | ||
* | * TheFlow for finding these vulnerabilities (before 2021-10-25) and disclosing them publicly on hackerone and hardwear.io (2022-06-10) | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://hackerone.com/reports/1379975] | |||
* [https://hackerone.com/reports/1379975 | |||
==== Bug | ==== Bug description ==== | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
==== Patched ==== | ==== Patched ==== | ||
'''No''' as of PS4 FW 9.00 and PS5 FW 4. | '''No''' as of PS4 FW 9.00 and PS5 FW 4.50. Probably at least partially patched on PS4 FW 9.50 and PS5 FW 5.00. | ||
== Usermode Exploits (WebKit) == | == Usermode Exploits (WebKit) == | ||
=== | === FW 9.00-9.03 - WebCore::CSSFontFaceSet vulnerabilities leading to arbitrary RW === | ||
There are many FontFaceSet vulnerabilities. Explore [https://trac.webkit.org/search?q=mmaxfield%40apple.com+FontFaceSet&noquickjump=1&changeset=on]. | There are many FontFaceSet vulnerabilities. Explore [https://trac.webkit.org/search?q=mmaxfield%40apple.com+FontFaceSet&noquickjump=1&changeset=on]. | ||
Line 474: | Line 57: | ||
* Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2021-10-13) | * Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2021-10-13) | ||
* PS Test discord server community for testing PoCs of many WebKit vulnerabilities on their PS4s (2021-10-13) | * PS Test discord server community for testing PoCs of many WebKit vulnerabilities on their PS4s (2021-10-13) | ||
* sleirsgoevy for making the first exploit PoC for Safari (2021-10-24) and the first exploit PoC for PS4 FW 9.00 | * sleirsgoevy for making the first exploit PoC for Safari (2021-10-24) and the first exploit PoC for PS4 FW 9.00 and PS5 FW 3.00-4.03 (2021-10-27) | ||
==== Analysis ==== | ==== Analysis ==== | ||
Line 487: | Line 70: | ||
* [https://github.com/WebKit/WebKit/commit/fbf37d27e313d8d0a150a74cc8fab956eb7f3c59 WebKit fix commit by Myles C. Maxfield merged by Russell Epstein (2021-09-09)] | * [https://github.com/WebKit/WebKit/commit/fbf37d27e313d8d0a150a74cc8fab956eb7f3c59 WebKit fix commit by Myles C. Maxfield merged by Russell Epstein (2021-09-09)] | ||
* [https://github.com/WebKit/WebKit/blob/74bd0da94fa1d31a115bc4ee0e3927d8b2ea571e/Source/WebCore/css/CSSFontFaceSet.cpp#L223 Part of vulnerable code] | * [https://github.com/WebKit/WebKit/blob/74bd0da94fa1d31a115bc4ee0e3927d8b2ea571e/Source/WebCore/css/CSSFontFaceSet.cpp#L223 Part of vulnerable code] | ||
* [ | * [https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2021/CVE-2021-30858.html Write-up and PoC by Maddie Stone (2021-10-13)] | ||
* [https://wololo.net/2021/10/14/use-after-free-webkit-vulnerability-impacts-ps4-possibly-up-to-firmware-9-00-included/ Vulnerability description by Wololo (2021-10-14)] | * [https://wololo.net/2021/10/14/use-after-free-webkit-vulnerability-impacts-ps4-possibly-up-to-firmware-9-00-included/ Vulnerability description by Wololo (2021-10-14)] | ||
* Warning: Maddie Stone's vulnerability is not CVE-2021-30858 but was guessed to be by Maddie Stone. See [https://github.com/googleprojectzero/0days-in-the-wild/commit/65fcdf0473ada4e80dc967662ea8f3f3ce4ea81e#diff-1a428c43cedcf140e5bd6f92e4527f169c3c717780e1586f2fab589e4f467b52 write-up edit commit]. | |||
* Warning: Maddie Stone's vulnerability was wrongly classified as a use-after-free by Maddie Stone according to sleirsgoevy. | |||
==== Bug description ==== | |||
Description in WebKit fix commit by Myles C. Maxfield: | Description in WebKit fix commit by Myles C. Maxfield: | ||
After r256659, asking for a failed CSSFontFace's families() returns nullopt. It's possible to add a failed font to a CSSFontFaceSet (of course). When we do that, we recognize the font is failed and | After r256659, asking for a failed CSSFontFace's families() returns nullopt. It's possible to add a failed font to a CSSFontFaceSet (of course). When we do that, we recognize the font is failed and don't update our internal data structures, because there's no need to - we can't do anything useful with a failed font. If you _then_ try to remove the font from the CSSFontFace, we don't call families(), but instead just pull out the raw m_families member, and look in our internal data structures for it, but we don't find it, because it was never added. | ||
Description in Maddie Stone's write-up: | Description in Maddie Stone's write-up: | ||
The vulnerability is a use-after-free due to an unchecked end() iterator. There was an assert statement: ASSERT(iterator != m_facesLookupTable.end());, but ASSERTs | The vulnerability is a use-after-free due to an unchecked end() iterator. There was an assert statement: ASSERT(iterator != m_facesLookupTable.end());, but ASSERTs don't do anything in release builds. Therefore, even if iterator == m_facesLookupTable.end() in the release build, nothing would happen and iterator would still be used. In FontFaceSet a FontFace is not added to the faces lookup table in addToFacesLookupTable if the font has already been deemed to be invalid. However, removeFromFacesLookupTable would still attempt to remove the font, leading to the use-after-free. The patch changes the ASSERT to an if clause. The function will return if iterator == m_facesLookupTable.end(), since the item it wishes to remove is not found in the table. | ||
Description by sleirsgoevy: | Description by sleirsgoevy: | ||
On PS4 FWs 9.00-9. | On PS4 FWs 9.00-9.03 the constructor returns with an exception, but to C++ code that ignores it. That is how an invalid font is created in the first place. On earlier PS4 FWs the exception is propagated to JavaScript. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [ | * [http://vdsina.sleirsgoevy.dynv6.net:8081/ First exploit PoC for Safari by sleirsgoevy (2021-10-24)] | ||
* [https://gist.github.com/sleirsgoevy/6beca32893909095f4bba1ce29167992 First exploit PoC for PS4 FW 9.00 | * [https://gist.github.com/sleirsgoevy/6beca32893909095f4bba1ce29167992 First exploit PoC for PS4 FW 9.00 and PS5 FW 3.00-4.03 by sleirsgoevy (2021-10-27)] | ||
==== Patched ==== | ==== Patched ==== | ||
''' | '''Not yet''' as of PS4 FW 9.03 and PS5 FW 4.50. | ||
Might have been introduced in PS4 FW 3.50 and before PS5 FW 1.00 according to dates (need to check). However the vulnerability cannot be exploited in some conditions depending on how WebKit was compiled. For example, on PS4 FWs 7.55-8.53 and PS5 FWs <= 2.00, the FontFaceSet constructor returns with an exception that is propagated to JavaScript, preventing exploitation this way. | Might have been introduced in PS4 FW 3.50 and before PS5 FW 1.00 according to dates (need to check). However the vulnerability cannot be exploited in some conditions depending on how WebKit was compiled. For example, on PS4 FWs 7.55-8.53 and PS5 FWs <= 2.00, the FontFaceSet constructor returns with an exception that is propagated to JavaScript, preventing exploitation this way. | ||
Tested working on PS4 FWs 9.00-9. | Tested working on PS4 FWs 9.00-9.03 and PS5 FWs 3.00-4.50. Untested: PS5 FWs 2.10-2.50. | ||
=== FW | === FW ?.??-7.55 - WebCore::ValidationMessage::buildBubbleTree() UaF leading to arbitrary RW === | ||
==== Credits ==== | ==== Credits ==== | ||
* Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) who are Security Researcher at Synacktiv for fuzzing WebKit, finding a way to exploit the vulnerability on PS4, presenting it on Black Hat Europe 2020 ([https://www.blackhat.com/eu-20/briefings/schedule/index.html#this-is-for-the-pwners--exploiting-a-webkit--day-in-playstation--21212]) and sharing the code (2020-12-10) | * Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) who are Security Researcher at Synacktiv for fuzzing WebKit, finding a way to exploit the vulnerability on PS4, presenting it on Black Hat Europe 2020 ([https://www.blackhat.com/eu-20/briefings/schedule/index.html#this-is-for-the-pwners--exploiting-a-webkit--day-in-playstation--21212]) and sharing the code (2020-12-10) | ||
* sleirsgoevy for porting (although with low success rate) to | * sleirsgoevy for porting (although with low success rate) to 7.00-7.02 | ||
==== Analysis ==== | ==== Analysis ==== | ||
Line 527: | Line 112: | ||
* [http://i.blackhat.com/eu-20/Thursday/eu-20-Meffre-This-Is-For-The-Pwners-Exploiting-A-Webkit-0day-In-Playstation4.pdf Presentation slides by by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)] | * [http://i.blackhat.com/eu-20/Thursday/eu-20-Meffre-This-Is-For-The-Pwners-Exploiting-A-Webkit-0day-In-Playstation4.pdf Presentation slides by by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)] | ||
==== Bug | ==== Bug description ==== | ||
* The method buildBubbleTree makes a call to update the layout during which all user registered JS handlers are executed. If the ValidationMessage is destroyed in a JS callback, this could lead to a Use-After-Free situation when we get back to buildBubbleTree code. | * The method buildBubbleTree makes a call to update the layout during which all user registered JS handlers are executed. If the ValidationMessage is destroyed in a JS callback, this could lead to a Use-After-Free situation when we get back to buildBubbleTree code. | ||
Line 541: | Line 127: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 8.00 FW. Tested working on FWs 6. | '''Yes''' in 8.00 FW. Tested working on FWs 6.72-7.55. | ||
=== FW 6.00-6.72 - bad_hoist Type Confusion exploit (CVE-2018-4386) leading to arbirary RW === | === FW 6.00-6.72 - bad_hoist Type Confusion exploit (CVE-2018-4386) leading to arbirary RW === | ||
Line 557: | Line 143: | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary | WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary doesn't invalidate the ForInContext object. | ||
It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated. | It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated. | ||
Line 571: | Line 157: | ||
---- | ---- | ||
=== FW | === FW 6.00-6.20 - JSArray::shiftCountWithArrayStorage() OOB RW (CVE-2018-4441) leading to arbitrary RW === | ||
==== Credits ==== | ==== Credits ==== | ||
Line 598: | Line 168: | ||
* [https://github.com/WebKit/webkit/commit/51a62eb53815863a1bd2dd946d12f383e8695db0 WebKit fix commit (Oct 15, 2018)] | * [https://github.com/WebKit/webkit/commit/51a62eb53815863a1bd2dd946d12f383e8695db0 WebKit fix commit (Oct 15, 2018)] | ||
* [https://mastodon.social/@buherator/101654714198519755 Announce of incoming write-up by rkmylo and buherator/stratan/@5tratan, Meligra Team (Feb 25, 2019)] | * [https://mastodon.social/@buherator/101654714198519755 Announce of incoming write-up by rkmylo and buherator/stratan/@5tratan, Meligra Team (Feb 25, 2019)] | ||
* [https://rstforums.com/forum/topic/110439-cve-2018-4441-oob-rw-via-jsarrayunshiftcountwitharraystorage-webkit/ Write-up | * [https://rstforums.com/forum/topic/110439-cve-2018-4441-oob-rw-via-jsarrayunshiftcountwitharraystorage-webkit/ Write-up by Nytro, Meligra Team (Feb 27, 2019)] | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
Line 607: | Line 177: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 6.50 FW | '''Yes''' in 6.50 FW | ||
---- | ---- | ||
=== FW 6.00-6.20 - JSC::arrayProtoPrivateFuncConcatMemcpy() Information Leak (CVE-2018-4358) ?leading to ASLR defeat? === | === FW 6.00-?6.20? - JSC::arrayProtoPrivateFuncConcatMemcpy() Information Leak (CVE-2018-4358) ?leading to ASLR defeat? === | ||
==== Credits ==== | ==== Credits ==== | ||
* bkth, niklasb and saelo (from phoenhex Team) for the exploit PoC in Safari (Sep 26, 2018) | * bkth, niklasb and saelo (from phoenhex Team) for the exploit PoC in Safari (Sep 26, 2018) | ||
* Vultra for discovering that the exploit worked | * Vultra for discovering that the exploit worked since FW 6.00 (Dec 10, 2018) | ||
==== Analysis ==== | ==== Analysis ==== | ||
Line 630: | Line 200: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 6.50 FW | '''Yes''' in 6.50/1 FW | ||
==== Tested ==== | ==== Tested ==== | ||
Line 658: | Line 228: | ||
---- | ---- | ||
=== FW | === FW 5.05 - Document::adoptNode() UaF leading to crash === | ||
==== Credits ==== | ==== Credits ==== | ||
* Lokihardt (from Google Project Zer0) for the exploit PoC (Jan 23, 2017) | * Lokihardt (from Google Project Zer0) for the exploit PoC (Jan 23, 2017) | ||
* CelesteBlue for testing on PS4 and | * CelesteBlue for testing on PS4 and PSVita | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1099 exploit report by Lokihardt (Jan 23, 2017)] | * [https://bugs.chromium.org/p/project-zero/issues/detail?id=1099 exploit report by Lokihardt (Jan 23, 2017)] | ||
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2468 | * [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2468 mitre report] | ||
* [https://www.exploit-db.com/exploits/41868 exploitDB report] | * [https://www.exploit-db.com/exploits/41868 exploitDB report] | ||
* [https://bugs.chromium.org/p/chromium/issues/detail?id=541206 related bug (Oct 8, 2015)] | |||
* [https://bugs.chromium.org/p/chromium/issues/detail?id=541206 | * Test on PSVita FW 3.60 by CelesteBlue (May 9, 2020) | ||
* Test on PS4 FW 5.05 by CelesteBlue (Aug 20, 2020) | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [https://github.com/Metnew/uxss-db/tree/master/webkit/CVE-2017-2468 PoC that just crashes on PS4 FW | * [https://github.com/Metnew/uxss-db/tree/master/webkit/CVE-2017-2468 PoC that just crashes on PS4 FW 5.05] | ||
==== Patched ==== | ==== Patched ==== | ||
''' | '''Maybe''' in ?6.00? FW. | ||
---- | ---- | ||
=== FW | === FW ?-5.05-? - WebCore::HTMLFrameElementBase::marginHeight() Heap UaF (CVE-2016-1859) leading to crash === | ||
PoC crashes the webbrowser. | |||
* [http://arayz.github.io/933ky/A-general-attack-model-of-UAF-on-browser/ Writeup by Arayz (Wang Ao) (March 31, 2017)] | * [http://arayz.github.io/933ky/A-general-attack-model-of-UAF-on-browser/ Writeup by Arayz (Wang Ao) (March 31, 2017)] | ||
=== FW 4.50-5.01 - Element::setAttributeNodeNS() UaF leading to arbitrary RW === | === FW 4.50-5.01 - Element::setAttributeNodeNS() UaF leading to arbitrary RW === | ||
Line 747: | Line 299: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3.15-4.07. Not working on <= 3.11. | Works on 3.15-4.07. Not working on <=3.11. | ||
---- | ---- | ||
Line 761: | Line 313: | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer | When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer isn't re-updated nor nulled. When this memory in free()'d, the reference is maintained and thus memory corruption can occur. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
Line 778: | Line 330: | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://github.com/WebKit/WebKit-http/commit/98845d940e30529098eea7e496af02e14301c704 WebKit fix commit | * [https://github.com/WebKit/WebKit-http/commit/98845d940e30529098eea7e496af02e14301c704 WebKit fix commit] | ||
* [https://xz.aliyun.com/t/292 Summary of Critical and Exploitable iOS Vulnerabilities in 2016 by Min (Spark) Zheng, Cererdlong, Eakerqiu @ Team OverSky] | * [https://xz.aliyun.com/t/292 Summary of Critical and Exploitable iOS Vulnerabilities in 2016 by Min (Spark) Zheng, Cererdlong, Eakerqiu @ Team OverSky] | ||
Line 797: | Line 349: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3.15, 3.50 FW. Maybe working on 3.51 FW. | Works on 3.15, 3.50 FW. Maybe working on 3.51 FW. | ||
---- | ---- | ||
Line 930: | Line 456: | ||
=== Usermode ASLR === | === Usermode ASLR === | ||
* Very old firmwares (<= 1.05) | * Very old firmwares (<= 1.05) don't have ASLR enabled, but it was introduced sometime before firmware 1.70. "Address Space Layout Randomization" (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4. | ||
* To defeat usermode ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address. | * To defeat usermode ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address. | ||
=== Module imports table cleaned before execution === | === Module imports table cleaned before execution === | ||
* Between 1.76 and 4.05, Sony did that to prevent | * Between 1.76 and 4.05, Sony did that to prevent webkit exploiters from defeating usermode ASLR easily. | ||
* Now we have to dump entire usermode sandboxed memory, and by studying it we can defeat ASLR: | * Now we have to dump entire usermode sandboxed memory, and by studying it we can defeat ASLR: | ||
1. Chose a function (ex: __stack_chk_fail) imported from | 1. Chose a function (ex: __stack_chk_fail) imported from LibKernel by SceWebkit2 | ||
2. Read pointer contained at the address where the call is done | 2. Read pointer contained at the address where the call is done | ||
3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | 3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | ||
4. This result is LibKernel base address. This method works for any imported module. | 4. This result is LibKernel base address. This method works for any imported module. | ||
=== DEP / NX === | === DEP / NX === | ||
* "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to usermode memory then executing it. | * "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to usermode memory then executing it. | ||
* 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs). | * 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs). | ||
=== JiT removed from webbrowser === | === JiT removed from webbrowser === | ||
* On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | * On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | ||
* Workaround is to use ROP. | * Workaround is to use ROP. | ||
=== Syscalls removed === | === Syscalls removed === | ||
=== Syscall 0 disabled i.e Error Kernel: The application directly issues a syscall instruction (24) === | === Syscall 0 disabled i.e Error Kernel: The application directly issues a syscall instruction (24) === | ||
Line 973: | Line 489: | ||
=== bpf_open function blocked for unprivileged processes === | === bpf_open function blocked for unprivileged processes === | ||
* On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF. | * On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF. | ||
=== bpf_ioctl function blocked or removed === | === bpf_ioctl function blocked or removed === | ||
* Moreover, on FW 5.50+, opening BPF is still possible in less sandboxed apps like test/devkits fselfs. But this is useless because ioctl doesn't work. | |||
* | |||
=== Device access blocked/removed from webbrowser === | === Device access blocked/removed from webbrowser === | ||
* Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from | * Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from webbrowser | ||
== Kernel Exploits == | == Kernel Exploits == | ||
=== FW <= | === FW <= 9.00 - exFAT driver OOB === | ||
==== Credits ==== | ==== Credits ==== | ||
* | * 2021-10-27 sleirsgoevy for PS4 <= 9.03 WebKit exploit | ||
* 2021-12-02 zecoxao for advicing the vulnerability after diffing 9.00 and 9.03 PS4 kernels | |||
* | * 2021-12-13 ChendoChap, Znullptr, Specter for PS4 9.00 kernel exploit release | ||
* | |||
==== Analysis ==== | ==== Analysis ==== | ||
[https://twitter.com/notzecoxao/status/1466463051872448521 Vulnerability adviced by zecoxao for exploitation (2021-12-02)] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
The PS4 kernel exFAT driver has an OOB vulnerability that can be triggered by inserting a malicious USB storage device in PS4 in addition to having usermode code execution. Exploitation requires to flash an image to a common USB storage device. | |||
The PS4 | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
Line 1,132: | Line 517: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in | '''Yes''' in 9.03 FW | ||
---- | ---- | ||
Line 1,176: | Line 561: | ||
* [https://asciinema.org/a/396409 Demonstration video of sleirsgoevy's second exploit PoC for FreeBSD 9 (2021-03-03)] | * [https://asciinema.org/a/396409 Demonstration video of sleirsgoevy's second exploit PoC for FreeBSD 9 (2021-03-03)] | ||
* [https://github.com/sleirsgoevy/ps4jb2/blob/75x/src/jb.c sleirsgoevy's implementation for PS4 7.5x (2021-03-12)] | * [https://github.com/sleirsgoevy/ps4jb2/blob/75x/src/jb.c sleirsgoevy's implementation for PS4 7.5x (2021-03-12)] | ||
==== Patched ==== | ==== Patched ==== | ||
Line 1,182: | Line 566: | ||
---- | ---- | ||
=== FW <= 7.02 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W | === FW <= 7.02 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) === | ||
==== Credits ==== | ==== Credits ==== | ||
* 2018-08-18 up to 2020-07-06 Fire30 for finding and keeping the vulnerability as a private 0day for it not to be patched by SIE. [https://twitter.com/Fire30_/status/1280228173888831490] | * 2018-08-18 up to 2020-07-06 Fire30 for finding and keeping the vulnerability as a private 0day for it not to be patched by SIE. [https://twitter.com/Fire30_/status/1280228173888831490] | ||
* 2020-07-06 TheFloW for publishing publicly a PoC leading to code execution on FreeBSD. [https://twitter.com/theflow0/status/1280224554393178122] | * 2020-07-06 TheFloW for publishing publicly a PoC leading to code execution on FreeBSD. [https://twitter.com/theflow0/status/1280224554393178122] | ||
* sleirsgoevy and ChendoChap for porting the PoC to PS4 and chaining it with the 6.72 and 7.02 | * sleirsgoevy and ChendoChap for porting the PoC to PS4 and chaining it with the 6.72 and 7.02 webkit exploits. | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://hackerone.com/reports/826026 TheFloW's | * [https://hackerone.com/reports/826026 TheFloW's report of the exploit with a FreeBSD 9-12 PoC] | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
Due to missing locks in option IPV6_2292PKTOPTIONS of setsockopt, it is possible to race and free the struct ip6_pktopts buffer, while it is being handled by ip6_setpktopt. This structure contains pointers (ip6po_pktinfo) that can be hijacked to obtain arbitrary kernel R/W primitives. As a consequence, it is easy to have kernel code execution. This vulnerability is reachable from WebKit sandbox and is available in the latest FW, that is 7.02. | Due to missing locks in option IPV6_2292PKTOPTIONS of setsockopt, it is possible to race and free the struct ip6_pktopts buffer, while it is being handled by ip6_setpktopt. This structure contains pointers (ip6po_pktinfo) that can be hijacked to obtain arbitrary kernel R/W primitives. As a consequence, it is easy to have kernel code execution. This vulnerability is reachable from WebKit sandbox and is available in the latest FW, that is 7.02. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [ | * [https://hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com/Y13EyQCGKEqxH8PpJgFKh5uY?response-content-disposition=attachment%3B%20filename%3D%22exploit.c%22%3B%20filename%2A%3DUTF-8%27%27exploit.c&response-content-type=text%2Fx-c%2B%2Bsrc&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAQGK6FURQ4G43T3HL%2F20200719%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20200719T222620Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEGUaCXVzLXdlc3QtMiJHMEUCIQD%2F0c09Z1wbdZi9kMJukdNUryexRJUKWxTiqcoAnsxE1gIgQqef8QiWKjHnPYTPLZO5P1KcXixsUrL2Z8AnnT404jEqtAMIHRABGgwwMTM2MTkyNzQ4NDkiDGkLHbTp2BRWlnoy5iqRA0gx69uKt57lUwOOB48RT1j6IEwp5FGjfVUviEc78dJ99qZaUUB%2FI%2BfRDN5J7OKceSsOZwZ1VebLhz2za2R2c5gjX9EtCWf%2Brl6EIvxMXSyC%2FYxnbAVAXvB8jf5sRWr%2FgqpUQbNr1V5JFbe6IYw%2FvlmiYqMzhSqBpupfI6E6cwa3luTr0GBWKR4lppzFXR7%2B6e9bUAC%2BQiQcPk%2FzNqKAGE%2FFKkDreC1Vvlct%2FvhqQ0HbaNesEQG%2F0qbv2%2B6UB9iU4n4uk369G%2BmwtnfEh0%2BEeptwYVwFApNIfwRdOXx%2FrPnL69fkuxjA8BKQpILIf2XYxrbtlE8Nth8z75cXxlFLgdfmhyidy2Q0wkjS45tx39ROJZQBC9g%2Fstx7u0jFZ1M3MJuBVJc%2FO5aWCPOBoZrQKpbAJqHSqF5x5ON3x%2BNkFbfMj%2B20qSfmBn7eT2FYBPR3bahKnI5lZeDzYAQgSIvUpAGW%2Fi2UL1ZmEqEKoV%2Fh67YYzCMzM3uUqPRuSGIeQsmUEQeY%2BjR7PPoR71928%2B%2FHFBbTMN%2FW0vgFOusB5oRuVzVviKnOLIHgixiK0h5rYZe5TfP3JtYhhy3XpV0RB3BliMzTvuhn5TevB9ZZlRYKnP7x08C888AIsUKSm3UuQpHmnZ1M5yeypI5MwjmLO51lBnQwigz0tHGDu2jlOLyvW9bXzFw1rNLSfM5x6dWmvMdYyTkStTFnwcN0V14U5EOVzdfo9WYogPfzq%2FEeOopTjDAusDtIBEtn4ILZxnlPxi8oLY8rI03lsF4GmRx6zQKJ%2Bzs44lQi5DRSMOueKTvWmPRaR83hUAIxlXdDCdM8wPYQe0eMl3V3macYTRK1FghrvW4BCo6ZqQ%3D%3D&X-Amz-Signature=2862cc641fee752f041d00f7d021826e09354ef202bb2da78a966e5b90830662 TheFloW's PoC for FreeBSD 9 and 12] | ||
* [https://github.com/sleirsgoevy/ps4jb PS4 6.72-7.02 WebKit + Kernel Exploit implementation by sleirsgoevy] | * [https://github.com/sleirsgoevy/ps4jb PS4 6.72-7.02 WebKit + Kernel Exploit implementation by sleirsgoevy] | ||
* [https://github.com/ChendoChap/ps4-ipv6-uaf PS4 5.05-7.02 WebKit + Kernel Exploit implementation by ChendoChap] | * [https://github.com/ChendoChap/ps4-ipv6-uaf PS4 5.05-7.02 WebKit + Kernel Exploit implementation by ChendoChap] | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in | '''Yes''' in 7.50 FW | ||
---- | ---- | ||
Line 1,298: | Line 675: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on FWs 4.00-4.05. On <= 3.70 FW we | Works on FWs 4.00-4.05. On <=3.70 FW we haven't found a way to leak the target object, but it might be doable as F0F did it on 1.01. | ||
---- | ---- | ||
Line 1,397: | Line 774: | ||
* [https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c398342ed6499a00fce0c081f7bf1efaaef1/kernel.js Detailed annotation of the PS4 5.05 kernel exploit by Specter] | * [https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c398342ed6499a00fce0c081f7bf1efaaef1/kernel.js Detailed annotation of the PS4 5.05 kernel exploit by Specter] | ||
* | * [https://web.archive.org/web/20210116214117/http://crack.bargains/02r0.pdf Zero2Ring0 Slides by qwertyoruiop] | ||
* [https://web.archive.org/web/20120512144251/https://marcoramilli.blogspot.com/2011/12/from-rop-to-jop.html From ROP to JOP article by Marco Ramilli] | * [https://web.archive.org/web/20120512144251/https://marcoramilli.blogspot.com/2011/12/from-rop-to-jop.html From ROP to JOP article by Marco Ramilli] | ||
Line 1,408: | Line 785: | ||
==== SMAP bypass method: CVE-2021-29628 ==== | ==== SMAP bypass method: CVE-2021-29628 ==== | ||
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP | A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP is not coming from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched on PS5 FW 2.30 or later according to dates. | ||
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd] | * [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd] | ||
Line 1,433: | Line 810: | ||
{{Reverse Engineering}} | {{Reverse Engineering}} | ||
<noinclude> | <noinclude>[[Category:Main]]</noinclude> | ||
[[Category:Main]] | |||
</noinclude> |