Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
== Hardware Exploits == | == Hardware Exploits == | ||
Line 100: | Line 31: | ||
== Usermode Exploits (Game Savedata) == | == Usermode Exploits (Game Savedata) == | ||
=== PS2 games savedata exploits === | === PS2 games savedata exploits === | ||
==== GTA III ==== | |||
* [https://github.com/halpz/re3/blob/9a7fa478578beaba947ea867c15a25e411d641d8/src/save/MemoryCard.cpp#L358 vulnerability] | |||
* | |||
The game does a copy from the memory card into a fixed-size buffer with size supplied by the savedata. | |||
==== Dark Cloud ==== | |||
* [https://www.youtube.com/results?search_query=%22dark+cloud%22+item+glitch+menu+before%3A2008-01-01 video of bug triggering] | |||
Moving the cursor and pressing X on the same frame in the items menu allows us to pick up an item from out-of-bounds memory, which results in exploitable behaviour. | |||
==== Okage Shadow King ==== | |||
* https:// | * [https://store.playstation.com/en-us/product/UP9000-CUSA02199_00-SCUS971290000001 PS4 digital version CUSA02199 of SCUS97129 on PS Store] | ||
It has a typical stack buffer oveflow if you extend the player/town name in a savedata. | |||
=== PS4/PS5 PS2emu sandbox escape (mast1c0re) === | === PS4/PS5 PS2emu sandbox escape (mast1c0re) === | ||
==== Credits ==== | ==== Credits ==== | ||
* CTurt for discovering these vulnerabilities in September 2021 | * CTurt for discovering these vulnerabilities in September 2021 | ||
* CTurt for public disclosure [https://twitter.com/CTurtE/status/1570189920844804097 on twitter] ( | * CTurt for public disclosure [https://twitter.com/CTurtE/status/1570189920844804097 on twitter] (2020-09-15) | ||
* flatz, balika011, theflow0, chicken(s), PlayStation for helping CTurt | * flatz, balika011, theflow0, chicken(s), PlayStation for helping CTurt | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://cturt.github.io/mast1c0re.html Writeup | * [https://cturt.github.io/mast1c0re.html Writeup by CTurt (2022-09-14)] | ||
==== Bug | ==== Bug description ==== | ||
After getting code execution in a PS2onPS4 game using a savedata exploit, it is possible to exploit the PS2 emulator to get x86-64 usermode ROP execution. It is then possible, without a kernel exploit, to load another PS2 game in the emulator with a compatibility rate based on the PS2 emulator configuration. | After getting code execution in a PS2onPS4 game using a savedata exploit, it is possible to exploit the PS2 emulator to get x86-64 usermode ROP execution. It is then possible, without a kernel exploit, to load another PS2 game in the emulator with a compatibility rate based on the PS2 emulator configuration. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* | * None | ||
==== Patched ==== | ==== Patched ==== | ||
'''No''' as of PS4 FW | '''No''' as of PS4 FW 10.00 and PS5 FW 6.00. | ||
== Usermode Exploits (BD-J) == | == Usermode Exploits (BD-J) == | ||
Advantages of most BD-J exploits over most WebKit exploits: | Advantages of most BD-J exploits over most WebKit exploits: | ||
* Bigger kernel attack surface (more usermode privileges) versus WebKit very restricted and becoming more and more with firmware revisions | * Bigger kernel attack surface (more usermode privileges) versus WebKit very restricted and becoming more and more with firmware revisions | ||
* 100% reliable versus WebKit exploits becoming less and less stable with firmware revisions | * 100% reliable versus WebKit exploits becoming less and less stable with firmware revisions | ||
* Firmware agnostic (ROP-less code execution) versus almost one WebKit revision every three firmware update | * Firmware agnostic (ROP-less code execution) versus almost one WebKit revision every three firmware update | ||
* JIT enabled allowing to write a kernel exploit in C versus writing in assembly and JavaScript since around FW 2.00 | * JIT enabled allowing to write a kernel exploit in C versus writing in assembly and JavaScript since around FW 2.00 | ||
=== FW <= 10. | === FW <=10.01 - Five vulnerabilities chained by TheFloW === | ||
==== Credits ==== | ==== Credits ==== | ||
* CTurt for [https://github.com/CTurt/FreeDVDBoot FreeDVDBoot exploit on PS2] and the idea to hack BD-J on PS3 and PS4 [https://twitter.com/CTurtE/status/1276946283941498881 on twitter] (2020-06-27) | * CTurt for [https://github.com/CTurt/FreeDVDBoot FreeDVDBoot exploit on PS2] and the idea to hack BD-J on PS3 and PS4 [https://twitter.com/CTurtE/status/1276946283941498881 on twitter] (2020-06-27) | ||
* | * TheFlow for finding these vulnerabilities (around 2021-10-24) and disclosing them publicly on hackerone and hardwear.io (2022-06-10) | ||
* Sleirsgoevy for writing the first public implementation (2022-06-16) | * Sleirsgoevy for writing the first public implementation (2022-06-16) | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://hackerone.com/reports/1379975 Official vulnerability report by TheFloW (2022-06-10)] | * [https://hackerone.com/reports/1379975 Official vulnerability report by TheFloW (2022-06-10)] | ||
* [https://github.com/TheOfficialFloW/Presentations/blob/master/2022-hardwear-io-bd-jb.pdf Slides presented at hardwear.io by TheFloW (2022-06-10)] | * [https://github.com/TheOfficialFloW/Presentations/blob/master/2022-hardwear-io-bd-jb.pdf Slides presented at hardwear.io by TheFloW (2022-06-10)] | ||
==== Bug | ==== Bug description ==== | ||
TO ADD DESCRIPTION OF EACH ONE OF THE 5 BUGS: | TO ADD DESCRIPTION OF EACH ONE OF THE 5 BUGS: | ||
Line 342: | Line 110: | ||
==== Patched ==== | ==== Patched ==== | ||
'''No''' as of PS4 FW | '''No''' as of PS4 FW 10.01 and PS5 FW 10.01. At least partially patched on PS4 FW 9.50 and PS5 FW 5.00. | ||
On PS4 FW 9.03 and PS5 FW ?4.50?, the bug #5 (UDF) has been patched. | On PS4 FW 9.03 and PS5 FW ?4.50?, the bug #5 (UDF) has been patched. | ||
Line 348: | Line 116: | ||
== Usermode Exploits (WebKit) == | == Usermode Exploits (WebKit) == | ||
=== | === FW 6.00-8.50-?.?? - FrameLoader::loadInSameDocument UaF (CVE-2022-22620) leading to crash === | ||
==== Credits ==== | ==== Credits ==== | ||
* Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2022-06-14) | * Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2022-06-14) | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22620.html Short writeup by Maddie Stone (2022-06-14)] | * [https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22620.html Short writeup by Maddie Stone (2022-06-14)] | ||
* [https://googleprojectzero.blogspot.com/2022/06/an-autopsy-on-zombie-in-wild-0-day.html Detailed writeup by Maddie Stone (2022-06-14)] | * [https://googleprojectzero.blogspot.com/2022/06/an-autopsy-on-zombie-in-wild-0-day.html Detailed writeup by Maddie Stone (2022-06-14)] | ||
==== Bug | ==== Bug description ==== | ||
The | The bug is related to web browser history and is triggered only when pressing back button (O on PS4 controller), but requires many attempts. On vulnerable PS4 FW, after 3 or 4 attempts it gives OOM. A way to know if the system is vulnerable is the appearance of the input HTML element the PoC page after the timeout. | ||
A way to know if the system is vulnerable is the appearance of the input HTML element | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* | * See PoC in Maddie Stone's writeups. | ||
==== Patched ==== | ==== Patched ==== | ||
''' | '''Maybe''' on PS4 FW 9.60 and '''Maybe''' on PS5 FW 4.51. | ||
Tested working on PS4 FWs 6.00-8.50 and PS5 FWs none. Untested: every PS5 FWs. PS4 FWs <=5.56 seems invulnerable as the HTML input field stays blur (blue outline) after second timeout whilst it should not if the console were exploitable. | |||
Tested working on PS4 FWs 6.00- | |||
=== FW 9.00-9.04 - WebCore::CSSFontFaceSet vulnerabilities leading to arbitrary RW === | === FW 9.00-9.04 - WebCore::CSSFontFaceSet vulnerabilities leading to arbitrary RW === | ||
Line 495: | Line 160: | ||
* [https://wololo.net/2021/10/14/use-after-free-webkit-vulnerability-impacts-ps4-possibly-up-to-firmware-9-00-included/ Vulnerability description by Wololo (2021-10-14)] | * [https://wololo.net/2021/10/14/use-after-free-webkit-vulnerability-impacts-ps4-possibly-up-to-firmware-9-00-included/ Vulnerability description by Wololo (2021-10-14)] | ||
==== Bug | ==== Bug description ==== | ||
Description in WebKit fix commit by Myles C. Maxfield: | Description in WebKit fix commit by Myles C. Maxfield: | ||
After r256659, asking for a failed CSSFontFace's families() returns nullopt. It's possible to add a failed font to a CSSFontFaceSet (of course). When we do that, we recognize the font is failed and | After r256659, asking for a failed CSSFontFace's families() returns nullopt. It's possible to add a failed font to a CSSFontFaceSet (of course). When we do that, we recognize the font is failed and don't update our internal data structures, because there's no need to - we can't do anything useful with a failed font. If you _then_ try to remove the font from the CSSFontFace, we don't call families(), but instead just pull out the raw m_families member, and look in our internal data structures for it, but we don't find it, because it was never added. | ||
Description in Maddie Stone's write-up: | Description in Maddie Stone's write-up: | ||
The vulnerability is a use-after-free due to an unchecked end() iterator. There was an assert statement: ASSERT(iterator != m_facesLookupTable.end());, but ASSERTs | The vulnerability is a use-after-free due to an unchecked end() iterator. There was an assert statement: ASSERT(iterator != m_facesLookupTable.end());, but ASSERTs don't do anything in release builds. Therefore, even if iterator == m_facesLookupTable.end() in the release build, nothing would happen and iterator would still be used. In FontFaceSet a FontFace is not added to the faces lookup table in addToFacesLookupTable if the font has already been deemed to be invalid. However, removeFromFacesLookupTable would still attempt to remove the font, leading to the use-after-free. The patch changes the ASSERT to an if clause. The function will return if iterator == m_facesLookupTable.end(), since the item it wishes to remove is not found in the table. | ||
Description by sleirsgoevy: | Description by sleirsgoevy: | ||
Line 532: | Line 198: | ||
* [http://i.blackhat.com/eu-20/Thursday/eu-20-Meffre-This-Is-For-The-Pwners-Exploiting-A-Webkit-0day-In-Playstation4.pdf Presentation slides by by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)] | * [http://i.blackhat.com/eu-20/Thursday/eu-20-Meffre-This-Is-For-The-Pwners-Exploiting-A-Webkit-0day-In-Playstation4.pdf Presentation slides by by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)] | ||
==== Bug | ==== Bug description ==== | ||
* The method buildBubbleTree makes a call to update the layout during which all user registered JS handlers are executed. If the ValidationMessage is destroyed in a JS callback, this could lead to a Use-After-Free situation when we get back to buildBubbleTree code. | * The method buildBubbleTree makes a call to update the layout during which all user registered JS handlers are executed. If the ValidationMessage is destroyed in a JS callback, this could lead to a Use-After-Free situation when we get back to buildBubbleTree code. | ||
Line 562: | Line 229: | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary | WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary doesn't invalidate the ForInContext object. | ||
It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated. | It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated. | ||
Line 752: | Line 419: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3.15-4.07. Not working on <= 3.11. | Works on 3.15-4.07. Not working on <=3.11. | ||
---- | ---- | ||
Line 766: | Line 433: | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer | When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer isn't re-updated nor nulled. When this memory in free()'d, the reference is maintained and thus memory corruption can occur. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
Line 802: | Line 469: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3.15, 3.50 FW. Maybe working on 3.51 FW. | Works on 3.15, 3.50 FW. Maybe working on 3.51 FW. | ||
---- | ---- | ||
Line 935: | Line 576: | ||
=== Usermode ASLR === | === Usermode ASLR === | ||
* Very old firmwares (<= 1.05) | * Very old firmwares (<= 1.05) don't have ASLR enabled, but it was introduced sometime before firmware 1.70. "Address Space Layout Randomization" (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4. | ||
* To defeat usermode ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address. | * To defeat usermode ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address. | ||
=== Module imports table cleaned before execution === | === Module imports table cleaned before execution === | ||
* Between 1.76 and 4.05, Sony did that to prevent | * Between 1.76 and 4.05, Sony did that to prevent webkit exploiters from defeating usermode ASLR easily. | ||
* Now we have to dump entire usermode sandboxed memory, and by studying it we can defeat ASLR: | * Now we have to dump entire usermode sandboxed memory, and by studying it we can defeat ASLR: | ||
1. Chose a function (ex: __stack_chk_fail) imported from | 1. Chose a function (ex: __stack_chk_fail) imported from LibKernel by SceWebkit2 | ||
2. Read pointer contained at the address where the call is done | 2. Read pointer contained at the address where the call is done | ||
3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | 3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | ||
4. This result is LibKernel base address. This method works for any imported module. | 4. This result is LibKernel base address. This method works for any imported module. | ||
=== DEP / NX === | === DEP / NX === | ||
* "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to usermode memory then executing it. | * "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to usermode memory then executing it. | ||
* 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs). | * 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs). | ||
=== JiT removed from webbrowser === | === JiT removed from webbrowser === | ||
* On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | * On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | ||
* Workaround is to use ROP. | * Workaround is to use ROP. | ||
=== Syscalls removed === | === Syscalls removed === | ||
=== Syscall 0 disabled i.e Error Kernel: The application directly issues a syscall instruction (24) === | === Syscall 0 disabled i.e Error Kernel: The application directly issues a syscall instruction (24) === | ||
Line 978: | Line 609: | ||
=== bpf_open function blocked for unprivileged processes === | === bpf_open function blocked for unprivileged processes === | ||
* On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF. | * On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF. | ||
=== bpf_ioctl function blocked or removed === | === bpf_ioctl function blocked or removed === | ||
* Moreover, on FW 5.50+, opening BPF is still possible in less sandboxed apps like test/devkits fselfs. But this is useless because ioctl doesn't work. | |||
* | |||
=== Device access blocked/removed from webbrowser === | === Device access blocked/removed from webbrowser === | ||
* Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from | * Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from webbrowser | ||
== Kernel Exploits == | == Kernel Exploits == | ||
=== FW <= 9.00 - PPPoE driver remote buffer overflow (CVE-2022-29867) === | === FW <= 9.00 - PPPoE driver remote buffer overflow (CVE-2022-29867) === | ||
Line 1,137: | Line 734: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in PS4 9.03 FW and PS5 4.50 FW | '''Yes''' in PS4 9.03 FW and PS5 4.50 FW. | ||
---- | ---- | ||
Line 1,194: | Line 791: | ||
* sleirsgoevy and ChendoChap for porting the PoC to PS4 and chaining it with the 6.72 and 7.02 WebKit exploits. | * sleirsgoevy and ChendoChap for porting the PoC to PS4 and chaining it with the 6.72 and 7.02 WebKit exploits. | ||
* SIE for not patching this vulnerability on PS5 even when patched on PS4. | * SIE for not patching this vulnerability on PS5 even when patched on PS4. | ||
* TheFlow for announcing that PS5 kernel was exploited: [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)] | * TheFlow for announcing that PS5 kernel was exploited: [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)] | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://hackerone.com/reports/826026 TheFloW's | * [https://hackerone.com/reports/826026 TheFloW's report of the PS4 kernel exploit with a FreeBSD 9-12 PoC] | ||
* [https://www.freebsd.org/security/advisories/FreeBSD-SA-20:20.ipv6.asc FreeBSD Security Advisory FreeBSD-SA-20:20.ipv6] | * [https://www.freebsd.org/security/advisories/FreeBSD-SA-20:20.ipv6.asc FreeBSD Security Advisory FreeBSD-SA-20:20.ipv6] | ||
* [https://www.freebsd.org/security/patches/SA-20:20/ipv6.patch FreeBSD patch for FreeBSD-SA-20:20.ipv6] | * [https://www.freebsd.org/security/patches/SA-20:20/ipv6.patch FreeBSD patch for FreeBSD-SA-20:20.ipv6] | ||
* [https://hackerone.com/reports/1441103 TheFloW's | * [https://hackerone.com/reports/1441103 TheFloW's report of the PS5 kernel exploit] | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
Line 1,208: | Line 805: | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [ | * [https://hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com/Y13EyQCGKEqxH8PpJgFKh5uY?response-content-disposition=attachment%3B%20filename%3D%22exploit.c%22%3B%20filename%2A%3DUTF-8%27%27exploit.c&response-content-type=text%2Fx-c%2B%2Bsrc&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAQGK6FURQ4G43T3HL%2F20200719%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20200719T222620Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEGUaCXVzLXdlc3QtMiJHMEUCIQD%2F0c09Z1wbdZi9kMJukdNUryexRJUKWxTiqcoAnsxE1gIgQqef8QiWKjHnPYTPLZO5P1KcXixsUrL2Z8AnnT404jEqtAMIHRABGgwwMTM2MTkyNzQ4NDkiDGkLHbTp2BRWlnoy5iqRA0gx69uKt57lUwOOB48RT1j6IEwp5FGjfVUviEc78dJ99qZaUUB%2FI%2BfRDN5J7OKceSsOZwZ1VebLhz2za2R2c5gjX9EtCWf%2Brl6EIvxMXSyC%2FYxnbAVAXvB8jf5sRWr%2FgqpUQbNr1V5JFbe6IYw%2FvlmiYqMzhSqBpupfI6E6cwa3luTr0GBWKR4lppzFXR7%2B6e9bUAC%2BQiQcPk%2FzNqKAGE%2FFKkDreC1Vvlct%2FvhqQ0HbaNesEQG%2F0qbv2%2B6UB9iU4n4uk369G%2BmwtnfEh0%2BEeptwYVwFApNIfwRdOXx%2FrPnL69fkuxjA8BKQpILIf2XYxrbtlE8Nth8z75cXxlFLgdfmhyidy2Q0wkjS45tx39ROJZQBC9g%2Fstx7u0jFZ1M3MJuBVJc%2FO5aWCPOBoZrQKpbAJqHSqF5x5ON3x%2BNkFbfMj%2B20qSfmBn7eT2FYBPR3bahKnI5lZeDzYAQgSIvUpAGW%2Fi2UL1ZmEqEKoV%2Fh67YYzCMzM3uUqPRuSGIeQsmUEQeY%2BjR7PPoR71928%2B%2FHFBbTMN%2FW0vgFOusB5oRuVzVviKnOLIHgixiK0h5rYZe5TfP3JtYhhy3XpV0RB3BliMzTvuhn5TevB9ZZlRYKnP7x08C888AIsUKSm3UuQpHmnZ1M5yeypI5MwjmLO51lBnQwigz0tHGDu2jlOLyvW9bXzFw1rNLSfM5x6dWmvMdYyTkStTFnwcN0V14U5EOVzdfo9WYogPfzq%2FEeOopTjDAusDtIBEtn4ILZxnlPxi8oLY8rI03lsF4GmRx6zQKJ%2Bzs44lQi5DRSMOueKTvWmPRaR83hUAIxlXdDCdM8wPYQe0eMl3V3macYTRK1FghrvW4BCo6ZqQ%3D%3D&X-Amz-Signature=2862cc641fee752f041d00f7d021826e09354ef202bb2da78a966e5b90830662 TheFloW's PoC for FreeBSD 9 and 12] | ||
* [https://github.com/sleirsgoevy/ps4jb PS4 6.72-7.02 WebKit + Kernel Exploit implementation by sleirsgoevy] | * [https://github.com/sleirsgoevy/ps4jb PS4 6.72-7.02 WebKit + Kernel Exploit implementation by sleirsgoevy] | ||
* [https://github.com/ChendoChap/ps4-ipv6-uaf PS4 5.05-7.02 WebKit + Kernel Exploit implementation by ChendoChap] | * [https://github.com/ChendoChap/ps4-ipv6-uaf PS4 5.05-7.02 WebKit + Kernel Exploit implementation by ChendoChap] | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in | '''Yes''' in 7.50 FW | ||
---- | ---- | ||
Line 1,303: | Line 900: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on FWs 4.00-4.05. On <= 3.70 FW we | Works on FWs 4.00-4.05. On <=3.70 FW we haven't found a way to leak the target object, but it might be doable as F0F did it on 1.01. | ||
---- | ---- | ||
Line 1,402: | Line 999: | ||
* [https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c398342ed6499a00fce0c081f7bf1efaaef1/kernel.js Detailed annotation of the PS4 5.05 kernel exploit by Specter] | * [https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c398342ed6499a00fce0c081f7bf1efaaef1/kernel.js Detailed annotation of the PS4 5.05 kernel exploit by Specter] | ||
* | * [https://web.archive.org/web/20210116214117/http://crack.bargains/02r0.pdf Zero2Ring0 Slides by qwertyoruiop] | ||
* [https://web.archive.org/web/20120512144251/https://marcoramilli.blogspot.com/2011/12/from-rop-to-jop.html From ROP to JOP article by Marco Ramilli] | * [https://web.archive.org/web/20120512144251/https://marcoramilli.blogspot.com/2011/12/from-rop-to-jop.html From ROP to JOP article by Marco Ramilli] | ||
Line 1,438: | Line 1,035: | ||
{{Reverse Engineering}} | {{Reverse Engineering}} | ||
<noinclude> | <noinclude>[[Category:Main]]</noinclude> | ||
[[Category:Main]] | |||
</noinclude> |