Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1,775: Line 1,775:


'''Yes''' around PS4 FW 1.70.
'''Yes''' around PS4 FW 1.70.
== Secure Kernel ==
=== <=?3.70? - Kernel ASLR collision leads to decrypted kernel partial leak - Matroska vulnerability ===
==== Credits ====
* anonymous for sharing decrypted PS4 6.00b1 kernel file (2019-03-20)
* shykelit for dumping 3.55 Jig PS4 kernel (2019-04-17)
* zecoxao for discovering Matroska kernels and giving them that name (2019-04-18)
* z80 for dumping 3.70 PS4 DevKit kernel (2019-04-18)
* AlexAltea for reverse engineering kernel, ubios and vbios
* Many people for sharing dumps of their PS4 kernels
* CelesteBlue for backporting kernel exploits to dump PS4 4.74 kernel (2018-11-18), 3.50 (2019-05-09), 3.70 (2019-05-15) and 3.15 (2019-05-25)
==== Bug description ====
The kernel memory contains the kernel fSELF but with decrypted data, which in turn can be decompressed to grab ubios, vbios, kernel boot code and partial kernel.
By dumping PS4 kernel memory with a kernel exploit, in order to dump the x86 kernel, we sometimes find a strange fSELF. This fSELF is only partial: 1.5MB, but should be 17MB if it was the x86 kernel. Luckily it is only compressed, not encrypted. When uncompressing it using offzip, we can see only 1 segment. That is because the other segments have been cutted and the segment is incomplete. But we can see that it is the decrypted x86 kernel, as confirmed by diffing with anonymously shared decrypted full x86 kernel. In the decrypted x86 kernel, you can see a second ELF header. It is once again only compressed and not encrypted, and this is what zecoxao named the "Matroska kernel".
Sadly, this vulnerability is random, as it relies on kernel ASLR which is itself random. So depending on the System Software version, as modules have different sizes, kernel ASLR has more (100% on 3.15, 3.50 and 3.70) or less (1% on ?4.74?) chances to leak the Matroska kernel. It is unknown how we could improve this success rate. Maybe by instead of rebooting, causing a kernel panic or rebooting to recovery, entering rest mode then disconnecting power supply. A way to accelerate the process would be to scan kernel memory and check magics to see if there is a Matroska kernel. If there is, dump it, else reboot and cross fingers.
Note: vbios seems to be the same from 3.50 to 6.00b1 at least.
==== Analysis ====
Since PS4 3.50 FW, ASLR (Address Space Layout Randomization) has been enabled in PS4 kernel.
During PS4 boot, the following operations are executed:
* the encrypted x86 kernel is loaded from [[Serial Flash]]
* the secure kernel decrypt the x86 kernel SELF, without uncompressing it to some fixed address: at 0xFFFFFFFF84000000 in the case of 3.xx and 5.xx firmwares or 0xFFFFFFFFC4000000 in the case of 4.xx.
* the secure kernel randomly chooses a base address for Kernel ASLR, starting from 0xFFFFFFFF80000000.
* the secure kernel uncompresses the x86 kernel to the address determined by Kernel ASLR.
On some PS4 boots, Kernel ASLR base address can be very near of Matroska kernel address and the lack of memory separation and wipe renders the dump of Matroska kernel possible with only kernel memory read access.
==== Patched ====
'''Yes''' partially in 4.00 FW by increasing the kernel ASLR base address but it might have reappeared in newer versions like since 5.00 or 4.74, but with lower success rate.
It was also not present on 1.76 and below, so probably appeared when Sony worked on adding ASLR in PS4 Kernel. Also note that Matroska kernel is present on 3.15 even though there is no Kernel ASLR in this version.


== Hardware Exploits ==
== Hardware Exploits ==
Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/Vulnerabilities"