Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 100: | Line 100: | ||
== Usermode Exploits (Game Savedata) == | == Usermode Exploits (Game Savedata) == | ||
=== PS2 games savedata exploits === | === PS2 games savedata exploits === | ||
Line 137: | Line 105: | ||
See [https://www.psdevwiki.com/ps2/Vulnerabilities#PS2_Savedata_exploits PS2 savedata exploits on PS2 Dev Wiki]. | See [https://www.psdevwiki.com/ps2/Vulnerabilities#PS2_Savedata_exploits PS2 savedata exploits on PS2 Dev Wiki]. | ||
Official PS2onPS4 games sold on the PS Store (as of | Official PS2onPS4 games sold on the PS Store (as of May 31, 2020): | ||
* | * The King of Fighters Collection: The Orochi Saga | ||
* | * The King of Fighters '98 Ultimate Match | ||
* The King of Fighters 2000 | |||
* Jak II: Renegade | |||
* Jak 3 | |||
* Jak X: Combat Racing | |||
* Jak and Daxter: The Precursor Legacy | |||
* Art of Fighting Anthology | * Art of Fighting Anthology | ||
* | * Red Faction | ||
* | * Red Faction II | ||
* | * Star Ocean Till The End Of Time | ||
* | * Resident Evil Code: Veronica X | ||
* Harvest Moon: Save the Homeland | |||
* Harvest Moon: A Wonderful Life Special Edition | |||
* Fatal Fury Battle Archives Vol. 2 | |||
* ADK Damshii | |||
* Fu'un Super Combo | |||
* Destroy All Humans! | * Destroy All Humans! | ||
* Destroy All Humans! 2 | * Destroy All Humans! 2 | ||
* | * Samurai Shodown VI | ||
* Red Dead Revolver | |||
* Metal Slug Anthology | |||
* Everybody's Tennis | |||
* Indigo Prophecy | |||
* Ape Escape 2 | |||
* Psychonauts | |||
* The Warriors | |||
* Forbidden Siren | |||
* Primal | |||
* Kinetica | |||
* Wild Arms 3 | |||
* Max Payne | |||
* Okage: Shadow King | |||
* Bully | |||
* Manhunt | |||
* Rise of the Kasai | |||
* Puzzle Quest: Challenge of the Warlords | |||
* Dark Chronicle | |||
* Star Wars Bounty Hunter | |||
* Star Wars Racer Revenge | |||
* Arc the Lad: Twilight of the Spirits | |||
* FantaVision | * FantaVision | ||
* | * PaRappa the Rapper 2 | ||
* | * Dark Cloud | ||
* GTA III | * GTA III | ||
* GTA Vice City | * GTA Vice City | ||
* GTA San Andreas | * GTA San Andreas | ||
* Rogue Galaxy | * Rogue Galaxy | ||
* The Mark of Kri | * The Mark of Kri | ||
* Twisted Metal: Black | * Twisted Metal: Black | ||
* War of the Monsters | * War of the Monsters | ||
Official PS2onPS4 games sold on Bluray Discs: | Official PS2onPS4 games sold on Bluray Discs: | ||
* Jak X Combat Racing™® UP9000-CUSA07842 | * Jak X Combat Racing™® UP9000-CUSA07842 | ||
* Jak II UP9000-CUSA07840 | * Jak II UP9000-CUSA07840 | ||
* Jak 3 UP9000-CUSA07841 | * Jak 3 UP9000-CUSA07841 | ||
* Jak and Daxter: The Precursor Legacy™ UP9000-CUSA02522_00-SCUS971240000001 https://image.api.playstation.com/cdn/UP9000/CUSA02522_00/o9zJoXqpd4lzarjIbvvZLFjYGLsLvqCp.png | |||
* Psychonauts UP2154-CUSA03881 | |||
* Red Faction 2 UP4389-CUSA06405 | |||
* Red Faction UP4389-CUSA06402 | |||
* Star Wars Racers Revenge UP1082-CUSA03474 | |||
* STAR WARS™ BOUNTY HUNTER™ (US version) UP1082-CUSA03472_00-SLUS204200000001 | |||
* STAR WARS™ BOUNTY HUNTER™ (EU version) EP1006-CUSA03493_00-SLES508310000001 | |||
* Indigo Prophecy™ UP1642-CUSA04798 | |||
* ADK Damashii UP0576-CUSA03783 | |||
* Fu'un Super Combo v2 UP0576-CUSA03784 | |||
* METAL SLUG ANTHOLOGY™ (US version by Limited Run #364) UP0576-CUSA03749_00-SLUS215500000001 https://image.api.playstation.com/cdn/UP0576/CUSA03749_00/ImHDRENlttkdiXlm3K8ejNVgLURd3uTw.png | * METAL SLUG ANTHOLOGY™ (US version by Limited Run #364) UP0576-CUSA03749_00-SLUS215500000001 https://image.api.playstation.com/cdn/UP0576/CUSA03749_00/ImHDRENlttkdiXlm3K8ejNVgLURd3uTw.png | ||
* METAL SLUG ANTHOLOGY™ (EU version by SNK) EP0576-CUSA04156_00-SLES546770000001 https://image.api.playstation.com/cdn/EP0576/CUSA04156_00/NN7npbsEvxIRGI8lBVhm9I5BwFzdGlOK.png | * METAL SLUG ANTHOLOGY™ (EU version by SNK) EP0576-CUSA04156_00-SLES546770000001 https://image.api.playstation.com/cdn/EP0576/CUSA04156_00/NN7npbsEvxIRGI8lBVhm9I5BwFzdGlOK.png | ||
* | * Destroy All Humans! (2005) (PS2 Classic by Limited Run #370, not to be confused with the remake EP4389-CUSA14910_00-DAH1REMAKEEU0000) UP4389-CUSA05232_00-SLUS209450000001 https://image.api.playstation.com/cdn/UP4389/CUSA05232_00/XrgVkqoR5rvZk4tAGi2j7OFfHpAZWKUu.png | ||
* Samurai Shodown VI (by Limited Run #329) UP0576-CUSA03787_00-SLUS216290000001 or EP0576-CUSA04158_00-SLES552920000001 https://image.api.playstation.com/cdn/UP0576/CUSA03787_00/CuLRRdOYvdge0IW9LL9Vewj44RCc6OAU.png https://image.api.playstation.com/cdn/EP0576/CUSA04158_00/7SrtqugKMJixAcbprEE0ExGUOHlhL0F7.png | * Samurai Shodown VI (by Limited Run #329) UP0576-CUSA03787_00-SLUS216290000001 or EP0576-CUSA04158_00-SLES552920000001 https://image.api.playstation.com/cdn/UP0576/CUSA03787_00/CuLRRdOYvdge0IW9LL9Vewj44RCc6OAU.png https://image.api.playstation.com/cdn/EP0576/CUSA04158_00/7SrtqugKMJixAcbprEE0ExGUOHlhL0F7.png | ||
* | * Fatal Fury Battle Archives Vol. 2 (by Limited Run #371) UP0576-CUSA03750_00-SLUS217230000001 https://image.api.playstation.com/cdn/UP0576/CUSA03750_00/gFCLAhlGZwvFkra1p2sozwIZ5SH1OyZO.png | ||
These PS2onPS4 games can be bought online directly via Limited Run Games for brand new or for example on Ebay for second hand or like new. | These PS2onPS4 games can be bought online directly via Limited Run Games for brand new or for example on Ebay for second hand or like new. | ||
=== PS4/PS5 PS2emu sandbox escape (mast1c0re) === | === PS4/PS5 PS2emu sandbox escape (mast1c0re) === | ||
Line 374: | Line 310: | ||
Tested working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60. | Tested working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60. | ||
=== FW 10.00-11.02 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to | === FW 10.00-11.02 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW === | ||
==== Credits ==== | ==== Credits ==== | ||
Line 386: | Line 322: | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
* TODO | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
Line 406: | Line 337: | ||
* Sergei Glazunov, Google Project Zero, for reporting the bug in 2013-01 and answering Maddie Stone's questions in 2022 (2013) | * Sergei Glazunov, Google Project Zero, for reporting the bug in 2013-01 and answering Maddie Stone's questions in 2022 (2013) | ||
* Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2022-06-14) | * Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2022-06-14) | ||
* | * Anonymous for making an OOM PoC for webkit-gtk, PS4 and PS5 (2023-10-03) then making an arbitrary RW PoC (PSFree) for webkit-gtk, PS4 6.00-9.60 and PS5 1.00-5.50 (2023-10-24) | ||
* CelesteBlue for testing and porting | * CelesteBlue for testing and porting anonymous' PSFree to PS4 6.00-9.60 and PS5 1.00-5.50 (2023-11-04) | ||
==== Analysis ==== | ==== Analysis ==== | ||
Line 461: | Line 392: | ||
* Simple PoC for ASAN webkit-gtk by Maddie Stone in Maddie Stone's writeups | * Simple PoC for ASAN webkit-gtk by Maddie Stone in Maddie Stone's writeups | ||
* [https://github.com/springsec/CVE-2022-22620/blob/main/CVE-2022-22620_infoleak_exploit.html Information leak PoC for webkit-gtk by springsec] | * [https://github.com/springsec/CVE-2022-22620/blob/main/CVE-2022-22620_infoleak_exploit.html Information leak PoC for webkit-gtk by springsec] | ||
* [https://discord.com OOM PoC for PS4 and PS5 by | * [https://discord.com OOM PoC for PS4 and PS5 by anonymous on ps4-dev discord (to mirror)] | ||
* [https://discord.com Arbitrary RW PoC (PSFree) for PS4 6.00-9.60 and PS5 1.00-5.50 by | * [https://discord.com Arbitrary RW PoC (PSFree) for PS4 6.00-9.60 and PS5 1.00-5.50 by anonymous on ps4-dev discord (to mirror)] | ||
==== Patched ==== | ==== Patched ==== | ||
Line 802: | Line 733: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3.15, 3.50 FW. Maybe working on 3.51 FW. | Works on 3.15, 3.50 FW. Maybe working on 3.51 FW. | ||
---- | ---- | ||