Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 1,470: Line 1,470:


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]


==== Patched ====
==== Patched ====
Line 1,477: Line 1,477:
==== Tested ====
==== Tested ====
Works on FWs 4.00-4.05. On <= 3.70 FW we have not found a way to leak the target object, but it might be doable as Fail0verflow did it on 1.01.
Works on FWs 4.00-4.05. On <= 3.70 FW we have not found a way to leak the target object, but it might be doable as Fail0verflow did it on 1.01.
----
=== FW <= ?4.05? - amd64_set_ldt Heap Overflow (CVE-2016-1885) ===
==== Credits ====
* 2016-10-25 This vulnerability was discovered and researched by Francisco Falcon from Core Exploit Writers Team
* 2016-10-25 Revised patch to address a problem pointed out by ahaha from Chaitin Tech.
==== Analysis ====
* https://www.freebsd.org/security/advisories/FreeBSD-SA-16:15.sysarch.asc
* https://www.coresecurity.com/core-labs/advisories/freebsd-kernel-amd64setldt-heap-overflow
* https://web.archive.org/web/20161028222346/https://www.securityfocus.com/archive/1/archive/1/537812/100/0/threaded
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1885
* https://www.mail-archive.com/[email protected]/msg132464.html
* https://svnweb.freebsd.org/base?view=revision&revision=296956
* https://wololo.net/2016/10/26/details-surface-ps4-4-01-jailbreak-potentially-enough-public-release-soon
==== Bug Description ====
The IA-32 architecture allows programs to define segments, which provides based and size-limited view into the program address space. The memory-resident processor structure, called Local Descriptor Table, usually abbreviated LDT, contains definitions of the segments. Since incorrect or malicious segments would breach system integrity, operating
systems do not provide processes direct access to the LDT, instead they provide system calls which allow controlled installation and removal of segments.
A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode.
sysarch is syscall #165 on FreeBSD 9.1 and on PS4. Sony removed set_ldt between System Software version 1.76 and 4.05, according to Red-EyeX32.
==== Exploit Implementation ====
==== Patched ====
'''Yes''' in some FW <= 4.05 and >= 2.00 as set_ldt was removed. The PS4 is maybe not vulnerable because of a possible lack of 32bit implementation for syscalls.
==== Tested ====
Not yet.
----
----


Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/Vulnerabilities"