Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 200: Line 200:
=== PS4/PS5 game savedata LUA exploit ===
=== PS4/PS5 game savedata LUA exploit ===


==== Credits ====
* Used by Flatz on 2023-07-27 in [https://wololo.net/2023/07/28/ps5-flat_z-dumps-ps5-secure-processor-confirms-he-has-a-ps5-hypervisor-exploit-via-a-ps4-game-save-exploit/ his Hypervisor exploit].
* Used by Flatz on 2023-07-27 in [https://wololo.net/2023/07/28/ps5-flat_z-dumps-ps5-secure-processor-confirms-he-has-a-ps5-hypervisor-exploit-via-a-ps4-game-save-exploit/ his Hypervisor exploit].
* Used by Flatz on 2024-09-14 in [https://gist.github.com/flatz/5e12f75cdb210516d31df03069f7ed0a his implementation of the umtx UaF kernel exploit].
* Used by Flatz on 2024-09-14 in [https://gist.github.com/flatz/5e12f75cdb210516d31df03069f7ed0a his implementation of the umtx UaF kernel exploit].


==== Bug description ====
* Some PS4 (or maybe PS5) games, in disc version (probably also available in PS Store version but potentially patched), can be exploited as they use some LUA interpreter, by crafting an evil save data.
Some PS4 (or maybe PS5) games, in disc version (probably also available in PS Store version but potentially patched), can be exploited as they use some LUA interpreter, by crafting an evil save data.
 
==== Vulnerable games ====
 
Not confirmed:
Pay Day 2, Mafia III, God of War (which one?).
 
Confirmed:
TODO


==== Analysis ====
* Possible vulnerable games: Pay Day 2, Mafia III, God of War (which one?).


==== Patched
* Not patched as of PS4 FW ?12.00? and PS5 FW 7.61.
'''No''' as of PS4 FW ?12.00? and PS5 FW 7.61.


== Usermode Exploits (BD-J) ==
== Usermode Exploits (BD-J) ==
Line 1,681: Line 1,671:


The PS4 Crypto Coprocessor (CCP) interface in Secure Kernel has a bug that allows to dump (or better saying, bruteforce) key rings from SAMU.
The PS4 Crypto Coprocessor (CCP) interface in Secure Kernel has a bug that allows to dump (or better saying, bruteforce) key rings from SAMU.
That is how AES/HMAC keys from PFS, portability keys, VTRM keys, etc can be retrieved. A crypto flaw was in the ability to issue HMAC operation with key length stricly lower than 16. For example, by setting it to 1 you can bruteforce key bytes one by one by comparing HMAC result with HMAC result with known partial key.
That is how AES/HMAC keys from PFS, portability keys, VTRM keys, etc can be retrieved. A crypto flaw was in ability to issue HMAC operation with key length < 16, for example, by setting it to 1 you can bruteforce key bytes one by one by comparing HMAC result with HMAC result with known partial key.  


This trick may work on other crypto hardware as well if it does not restrict key lengths. Amazingly, Intel Secure Key Storage (SKS) of CSME subsystem also has a bug allowing to brute-force any key slot, but the issue exists at hardware level - insecure design of  the keys distribution to crypto engines (AES, SHA, RC4). Intel did not recognize the bug arguing that to access SKS the CSME privileged arbitrary code execution is required, but SKS is exactly designed to protect the ROM generated keys from CSME firmware...
This trick may work on other crypto hardware as well if it does not restrict key lengths. Amazingly, Intel Secure Key Storage (SKS) of CSME subsystem also has a bug allowing to brute-force any key slot, but the issue exists at hardware level - insecure design of  the keys distribution to crypto engines (AES, SHA, RC4). Intel did not recognize the bug arguing that to access SKS the CSME privileged arbitrary code execution is required, but SKS is exactly designed to protect the ROM generated keys from CSME firmware...
This can be used to dump the AES XTS key and HMAC key of a specific PS4 game PKG. Then one can use maxton's LibOrbisPkg or flatz's pkg_pfs_tool to unpack this PKG file.


==== Analysis ====
==== Analysis ====
Line 1,696: Line 1,684:
==== Implementation ====
==== Implementation ====


* [https://github.com/jocover/ps4-hen-vtx/releases/tag/pfs_dump Compiled payload for PS4 5.05 by jogolden]
* [https://gist.github.com/flatz/22215327864d7512e52268f9c9c51cd8 Exploit PoC for PS4 FW 7.55]
* [https://github.com/jocover/ps4-hen-vtx/tree/samu_key_dump Implementation for PS4 5.05 by jogolden]
* [https://gist.github.com/flatz/22215327864d7512e52268f9c9c51cd8 Exploit PoC for PS4 7.55 by flatz]


==== Patched ====
==== Patched ====
Line 1,818: Line 1,804:
=== PCIe man-in-the-middle attack ===
=== PCIe man-in-the-middle attack ===


* First done on PS4 FW 1.01 by failoverflow on PS4 launch!
* First done on 1.01 by failoverflow on PS4 launch !
* Detailed at 33c3: [https://fail0verflow.com/media/33c3-slides/#/5 33c3 slides by Marcan]
* Detailed at 33c3: [https://fail0verflow.com/media/33c3-slides/#/5 33c3 slides by Marcan]
* Permits kernel and usermode dumping
* Permits kernel and usermode dumping
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/Vulnerabilities"