Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1,514: Line 1,514:
=== CR0.WP protection ===
=== CR0.WP protection ===


At least since PS4 System Software version 6.51, Sony instrumented all instructions that write to the CR0 register with checks for attempts to clear CR0.WP (Write Protect), which is necessary for patching the kernel. This is what it looks like in 6.51 kernel:
At least since firmware 6.51 Sony instrumented all instructions that write to the CR0 register with checks for attempts to clear CR0.WP (Write Protect), which is necessary for patching the kernel. This is what it looks like in 6.51 kernel:


   a1b79:      0f 22 c0                mov    cr0,rax
   a1b79:      0f 22 c0                mov    cr0,rax
Line 1,525: Line 1,525:


Bypasses (in chronological order):
Bypasses (in chronological order):
* Execute an unintended "move to cr0" instruction in the middle of another instruction (e.g. instruction "call $+0x220f1c" (e8 17 0f 22 00) contains an unintended "mov cr0, rax" (0f 22 00))
 
* Use kernel write to give your process JIT permissions, allocate JIT memory, and put entirely custom code there (avoids the problem altogether, as it is specific to ROP). This seems impossible on PS5 with a classic kernel exploit because of XOM.
* Use an "unintended" mov to cr0 in the middle of another instruction (e.g. instruction "call $+0x220f1c" (e8 17 0f 22 00) contains an unintended "mov cr0, rax" (0f 22 00))
* Since the IDT (Interrupt Descriptor Table) is writable on FreeBSD, PS4 and PS5, it is possible to overwrite an exception handler without clearing CR0.WP first. One can overwrite the handler of #UD with a gadget of their choice (a stack pivot, or an "add rsp, ... ; ret" instruction, or whatever), then the UD2 instruction in the mitigation code will happily jump to it instead of the real handler, with CR0.WP cleared. To be precise, one must set up IDT handlers and point the IST (Interrupt Stack) to a ROP chain. It is required to poison the upper 16 bits of a pointer to make it non-canonical. Finally, write a custom page fault handler to run any kernel code you want. This technique proposed by sleirsgoevy since PS4 System Software version 6.51 was later adapted to PS5. However, this method slows down system performance compared to native execution because alone it can just run kernel ROP chains and it requires knowledge of gadgets positions. So on PS4, it is better to only use the IDT trick initially in a kernel exploit to patch kernel and allow non-ROP code execution for example by allowing JIT. On PS5, it is required to bypass XOM so an hypervisor exploit is required.
* Use kernel write to give your process JIT permissions, allocate JIT memory, and put entirely custom code there (avoids the problem altogether, as it is specific to ROP)
* Since the IDT is writable on FreeBSD and PS4, it is possible to overwrite an exception handler without clearing CR0.WP first. One can overwrite the handler of #UD with a gadget of their choice (a stack pivot, or a "add rsp, ... ; ret", or whatever else), and the UD2 instruction in the mitigation code will happily jump to it instead of the real handler, with CR0.WP cleared.
 


== Secure Modules ==
== Secure Modules ==
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/Vulnerabilities"