Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 32: Line 32:


"I have bought some of them on the PS3/Vita and the ones I could claim on the PS4/PS5 were Tekken 2 (which previously was not redeemable), all Syphon Filter games, all Wild Arms games, Legend of Dragoon, Ridge Racer Type 4 and Jumping Flash. Resident Evil Director's Cut is NOT redeemable. The rule of thumb is: if you can buy it on PS4/PS5 - and not only claim it through plus premium/deluxe sub, like Resident Evil 1 - they are redeemable from a previous purchase on PS3/PSP/Vita."
"I have bought some of them on the PS3/Vita and the ones I could claim on the PS4/PS5 were Tekken 2 (which previously was not redeemable), all Syphon Filter games, all Wild Arms games, Legend of Dragoon, Ridge Racer Type 4 and Jumping Flash. Resident Evil Director's Cut is NOT redeemable. The rule of thumb is: if you can buy it on PS4/PS5 - and not only claim it through plus premium/deluxe sub, like Resident Evil 1 - they are redeemable from a previous purchase on PS3/PSP/Vita."
Official PS Classic games (warning: some may be remastered, to check) on PS4/PS5 sold on Bluray Discs:
* Tomba! by LRG (for PS5: UP6893-PPSA21381_00-0240103642659799-U001)
* TBA 2025 by LRG: Tomba 2 The Evil Swine Return
* TBA 2025 by LRG: Gex Trilogy: Gex, Gex Enter the Gecko, Gex 3 Deep Cover Gecko
* TBA 2025 by LRG: Clock Tower: Rewind https://store.playstation.com/en-us/concept/10010305 Notice: PS1 Clock Tower is not the original game. The first game in the series was Clock Tower (1995) - first released on the SNES, later ported to PS1, PC and WonderSwan, but only ever released in Japan. The PS1 game is the second game, and was called Clock Tower 2 in Japan but just Clock Tower everywhere else, even though it is a sequel and not a port of the original. So Clock Tower 2 on the PS1 is the third game, and Clock Tower 3 on the PS2 is the fourth game.
* TBA 2025 by LRG: Fear Effect
* TBA 2025 by LRG: Fighting Force and Fighting Force 2
"Five PS1 games were recently announced for PS5 and PS4 with trophy support: Gex, Gex Enter the Gecko, Gex 3 Deep Cover Gecko, Clock Tower, and Tomba. All five games were announced to be using Limited Run Games' Carbon Engine, which so far has been primarily used to support older console emulation like the SNES and Sega Genesis, but has now officially revealed support for Sony's original PlayStation as well. These PS1 ports for PS5 and PS4 will use Limited Run Games' "Carbon Engine," which allows these classic titles to implement modern features like trophy support."


=== PS2 games savedata exploits ===
=== PS2 games savedata exploits ===
Line 60: Line 50:
* FantaVision
* FantaVision
* Fatal Fury Battle Archives Vol. 2
* Fatal Fury Battle Archives Vol. 2
* Forbidden Siren EP9000-CUSA02274_00-SCES519200000001 patch 1.01 requires PS4 3.10
* Forbidden Siren
* Fu'un Super Combo UP0576-CUSA03784_00-SLPS257810000001 https://image.api.playstation.com/cdn/UP0576/CUSA03784_00/QWsetumZLYupFHsOIkoGbKYpySGBdtlp.png
* Fu'un Super Combo UP0576-CUSA03784_00-SLPS257810000001 https://image.api.playstation.com/cdn/UP0576/CUSA03784_00/QWsetumZLYupFHsOIkoGbKYpySGBdtlp.png
* Ghosthunter (English, Japanese) UP9000-CUSA47996_00-SLUS209930000000
* Ghosthunter (English, Japanese) UP9000-CUSA47996_00-SLUS209930000000
Line 70: Line 60:
* Hot Shots® Tennis (Everybody's Tennis) UP9000-CUSA02193_00-SCUS976100000001 https://image.api.playstation.com/cdn/UP9000/CUSA02193_00/FrJXexHruy7pjB6bCgDidXRbakNfNJJc.png
* Hot Shots® Tennis (Everybody's Tennis) UP9000-CUSA02193_00-SCUS976100000001 https://image.api.playstation.com/cdn/UP9000/CUSA02193_00/FrJXexHruy7pjB6bCgDidXRbakNfNJJc.png
* Indigo Prophecy
* Indigo Prophecy
* Jak and Daxter™ HP9000-CUSA08427_00-SCPS560030000001 patch 1.01 requires PS4 4.73
* Jak and Daxter: The Precursor Legacy
* Jak and Daxter: The Precursor Legacy™ UP9000-CUSA02522_00-SCUS971240000001 patch 1.01 requires PS4 4.73
* Jak II: Renegade
* Jak and Daxter™: The Precursor Legacy EP9000-CUSA07934_00-SCES503610000001 patch 1.03 requires PS4 4.73
* Jak 3
* Jak II™ UP9000-CUSA07840_00-SCUS972650000001 patch 1.01 requires PS4 5.01
* Jak X: Combat Racing
* Jak II™ EP9000-CUSA07990_00-SCES516080000001 patch 1.02 requires PS4 5.01
* Jak II™ HP9000-CUSA08422_00-SCKA200100000001 patch 1.01 requires PS4 5.01
* Jak 3™ UP9000-CUSA07841_00-SCUS973300000001 patch 1.01 requires PS4 5.01
* Jak 3™ EP9000-CUSA07991_00-SCES524600000001 patch 1.01 requires PS4 5.01
* Jak 3™ HP9000-CUSA08423_00-SCKA200400000001 patch 1.01 requires PS4 5.01
* Jak X: Combat Racing UP9000-CUSA07842_00-SCUS974290000001 patch 1.02 requires PS4 5.01
* Jak™ X EP9000-CUSA07992_00-SCUS974290000001 patch 1.02 requires PS4 5.01
* Kinetica UP9000-CUSA01725_00-SCUS971320000001 https://image.api.playstation.com/cdn/UP9000/CUSA01725_00/EKH34FKOEt3dTXLCiccuawdS8iGIqGLF.png
* Kinetica UP9000-CUSA01725_00-SCUS971320000001 https://image.api.playstation.com/cdn/UP9000/CUSA01725_00/EKH34FKOEt3dTXLCiccuawdS8iGIqGLF.png
* Manhunt
* Manhunt
* Max Payne
* Max Payne
* Metal Slug Anthology
* Metal Slug Anthology
* Mister Mosquito UP9000-CUSA48755_00-SLUS203750000000 (for PS5: UP9000-PPSA22948_00-SLUS203750000000) patch 1.02 requires PS4 11.52 or PS5 9.60
* Okage: Shadow King UP9000-CUSA02199_00-SCUS971290000001, requires PS4 FW version 3.15, although it was compiled with PS4 SDK version 3.008.000, latest patch requires PS4 FW 4.05
* Okage: Shadow King UP9000-CUSA02199_00-SCUS971290000001, requires PS4 FW version 3.15, although it was compiled with PS4 SDK version 3.008.000, latest patch requires PS4 FW 4.05
* PaRappa the Rapper 2
* PaRappa the Rapper 2
Line 97: Line 79:
* Rise of the Kasai
* Rise of the Kasai
* Rogue Galaxy
* Rogue Galaxy
* Samurai Shodown VI
* Samurai Shodown VI  
* Siren UP9000-CUSA02198_00-SCUS973550000001 (for PS5: UP9000-PPSA22947_00-SCUS973550000000) PS4 patch 1.02 requires PS4 3.00 and PS5 patch 1.00 requires PS5 9.40
* SkyGunner UP9000-CUSA49210_00-SLUS203840000000 (for PS5: UP9000-PPSA23535_00-SLUS203840000000) patch 1.03 requires PS4 11.52 or PS5 9.60
* Sly Raccoon (2002), Sly Cooper and the Thievius Racoonus UP9000-CUSA47431_00-SCUS971980000000 requires PS4 FW ?11.00? (update requires PS4 11.508.000)
* Sly Raccoon (2002), Sly Cooper and the Thievius Racoonus UP9000-CUSA47431_00-SCUS971980000000 requires PS4 FW ?11.00? (update requires PS4 11.508.000)
* Star Ocean Till The End Of Time
* Star Ocean Till The End Of Time
Line 108: Line 88:
https://image.api.playstation.com/cdn/EP1006/CUSA03494_00/9MsXVY5UULzSHB5BTreuKhwep3KZwvQP.png
https://image.api.playstation.com/cdn/EP1006/CUSA03494_00/9MsXVY5UULzSHB5BTreuKhwep3KZwvQP.png
* STAR WARS The Clone Wars UP1082-CUSA48010_00-SLUS205100000000
* STAR WARS The Clone Wars UP1082-CUSA48010_00-SLUS205100000000
* Summoner UP4389-CUSA48889_00-SLUS200740000000 (for PS5: UP4389-PPSA23124_00-SLUS200740000000) PS4 patch 1.01 requires PS4 11.50, PS5 patch 1.02 requires PS5 9.40
* The King of Fighters Collection: The Orochi Saga
* The King of Fighters Collection: The Orochi Saga
* The King of Fighters '98 Ultimate Match
* The King of Fighters '98 Ultimate Match
Line 114: Line 93:
* The Mark of Kri
* The Mark of Kri
* The Warriors
* The Warriors
* Timesplitters EP4062-CUSA49387_00-SLUS200900000000 (for PS5: EP4062-PPSA23799_00-SLUS200900000000) PS4 patch 1.01 requires PS4 11.52, PS5 patch 1.00 requires PS5 9.40
* TimeSplitters 2 EP4062-CUSA49392_00-SLUS203140000000 (for PS5: EP4062-PPSA23801_00-SLUS203140000000) PS4 patch 1.01 requires PS4 11.52, PS5 patch 1.00 requires PS5 9.40
* TimeSplitters: Future Perfect EP4062-CUSA49435_00-SLUS211480000000 (for PS5: EP4062-PPSA23847_00-SLUS211480000000) PS4 patch 1.01 requires PS4 11.52, PS5 patch 1.00 requires PS5 9.40
* Tomb Raider: Legend UP8489-CUSA48389_00-SLUS212030000000 https://store.playstation.com/store/api/chihiro/00_09_000/titlecontainer/SE/en/999/CUSA48389_00/image
* Tomb Raider: Legend UP8489-CUSA48389_00-SLUS212030000000 https://store.playstation.com/store/api/chihiro/00_09_000/titlecontainer/SE/en/999/CUSA48389_00/image
* Twisted Metal: Black
* Twisted Metal: Black
Line 167: Line 143:
* Resistance: Retribution (2009) UP9000-CUSA32636_00-UCUS986680000000 or EP9000-CUSA32637_00-UCES011840000000
* Resistance: Retribution (2009) UP9000-CUSA32636_00-UCUS986680000000 or EP9000-CUSA32637_00-UCES011840000000
* Jeanne d’Arc (2006) UP9000-CUSA41018_00-UCUS987000000000
* Jeanne d’Arc (2006) UP9000-CUSA41018_00-UCUS987000000000
* Jak and Daxter: The Lost Frontier UP9000-CUSA41282_00-NPUG803300000000 (for PS5: UP9000-PPSA14325_00-NPUG803300000000-U001) patch 1.02 requires PS4 11.50 or PS5 9.00
* LEGO Star Wars II: The Original Trilogy UP1082-CUSA41250_00-ULUS101550000000 (for PS5: UP1082-PPSA14300_00-ULUS101550000000, UP1082-PPSA14300_00-0804842924824650-U002) or EP1006-CUSA41251_00-ULES004790000000, patch 1.01 requires PS4 11.50 or PS5 9.20
* Daxter UP9000-CUSA36097_00-NPUG803290000000 (for PS5: UP9000-PPSA09695_00-NPUG803290000000-U001) patch 1.01 requires PS4 11.50 or PS5 9.20


=== PS4/PS5 PS2emu sandbox escape (mast1c0re) ===
=== PS4/PS5 PS2emu sandbox escape (mast1c0re) ===
Line 287: Line 260:
=== WebKit sources ===
=== WebKit sources ===


[https://doc.dl.playstation.net/doc/ps4-oss/webkit.html WebKit sources]
[https://web.archive.org/web/20231108165430/https://doc.dl.playstation.net/doc/ps4-oss/webkit.html WebKit sources] Currently archived up to version 10.01. Useful for developers that can't access PlayStation URLs and also for when Sony inevitably stops hosting the sources in the future.


[https://web.archive.org/web/20241007081407/https://doc.dl.playstation.net/doc/ps4-oss/webkit.html WebKit sources] archived currently up to version 11.00. Useful for people that cannot access PlayStation URLs and also for when Sony will inevitably stop hosting the sources.
=== FW ?10.00?-11.52 - Unknown heap and string overflow (no CVE) leading to crash ===
 
=== FW ?6.00-11.52? - get_by_id_with_this associated with ProxyObject can leak JSScope objects ===


==== Credits ====
==== Credits ====
* Alexey Shvayka for discovery (2021-05-05) and incremental fixes (from 2021-05-20 to 2024-07-31)
* Debty for PoC public disclose (2024-08-29)
* Filip Pizlo for reviewing and not pushing it (2021-06-10)
* Ahmad Saleem for reminding WebKit that it is still not fixed (2022-09-03)
* Yusuke Suzuki and Justin Michaud for fix commits review.


==== Analysis ====
==== Analysis ====
* [https://github.com/WebKit/WebKit/pull/35527 Fix commit #3 by Alexey Shvayka (2024-10-21)]
* [https://github.com/Debvt/Wm/tree/Root0 PoC and analysis by Debty (2024-08-29)]
* [https://github.com/WebKit/WebKit/pull/31572 Fix commit #2 by Alexey Shvayka (2024-07-31)]
* [https://github.com/WebKit/WebKit/commit/ceb7e89febcd92b46d65396ce68e0d58ae6bcd6e Fix commit #1 for ProxyObject by Alexey Shvayka (2024-03-14)]
* [https://github.com/WebKit/WebKit/blob/6bb75cf119f4cf3c077ec234af476fb575b28509/Source/WebCore/bindings/js/JSDOMOperation.h#L38 Workaround leftover by Alexey Shvayka (2021-05-20)]
* [https://github.com/WebKit/WebKit/commit/6bb75cf119f4cf3c077ec234af476fb575b28509 Incremental fix commit by Alexey Shvayka (2021-05-20)]
* [https://bugs.webkit.org/show_bug.cgi?id=225397 Bug report on WebKit Bugzilla by Alexey Shvayka (2021-05-05)]


==== Bug Description ====
==== Bug Description ====
* TODO: document the general vulnerability coming from |this|.
* TODO


According to the spec [1], `var base = { foo }; with (base) foo();` should be called with `this`
Implementation description by Debty:<br />
value of `base`, which is why FunctionCallResolveNode moves resolved scope to thisRegister().
String exploit is not actually an exploit but just a memory exhauster. It is not actually viable so instead there is a feature called "latest iteration".
That is arguably a bad design, and there is an effort [2] to abolish using JSScope as `this` value.
 
When `this` value is accessed by JS code, it's being sanitized via ToThis (JSScope replaced with
`undefined`), yet not in case of `super.property` access calling into ProxyObject `get` trap,
which passes raw `this` value as receiver parameter, leaking JSScope to be exploited.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/shvaikalesh/WebKit/blob/ee167b8fe4fd234a33b2381640cba982fa6c7516/JSTests/stress/evaluate-with-scope-extension.js Stress code by Alexey Shvayka (2024-10-21)]
* [https://github.com/Debvt/Wm/tree/Root0 PoC by Debty (2024-08-29)]
* [https://github.com/WebKit/WebKit/blob/ceb7e89febcd92b46d65396ce68e0d58ae6bcd6e/JSTests/stress/regress-120777816.js Regression test by Alexey Shvayka (2024-03-14)]


==== Patched ====
==== Patched ====
'''Maybe'''
'''Yes''' on PS4 FW 12.00 and PS5 FW 10.00.


==== Tested ====
Tested working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.
Not tested yet on PS4 or PS5.
----


=== FW ?10.00-11.52? - Immediate overflow/underflow in JSC SBFX (CVE-2024-27833) leading to arbitrary code execution ===
=== FW 10.00-11.02 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to crash ===


==== Credits ====
==== Credits ====
* Manfred Paul (@_manfp), working with Trend Micro Zero Day Initiative, for discovering the vulnerability on Apple Safari at pwn2own 2024 (2024-03-21) [https://twitter.com/thezdi/status/1770611705510293546 Zero Day Initiative's tweet]
* ENKI for public disclose and analysis (2024-06-03)
* Justin Michaud for fix commit, Yusuke Suzuki for fix commit review (2024-05-15)
* Apple disclose that Safari update integrates the fix (2024-06-10)
* xvonfers and Bearseater (@JamesMa52390215) for discovering it affects PS4 and PS5 (2024-06-11) [https://twitter.com/xvonfers/status/1800426437486485635 xvonfer's tweet]


==== Analysis ====
==== Analysis ====
* [https://github.com/WebKit/WebKit/commit/1ea4ef8127276fd00ca43ffcb22bed162072abde WebKit fix commit by Justin Michaud (2024-05-15)]
* [https://medium.com/@enki-techblog/ios-16-5-1-safari-rce-analysis-cve-2023-37450-89bb8583bebc Analysis by ENKI (2024-06-03)]
* [https://bugs.webkit.org/show_bug.cgi?id=271491 WebKit Bugzilla #271491 with restricted access]
* [https://github.com/WebKit/WebKit/commit/1b0741f400ee2d31931ae30f2ddebe66e8fb0945 Patch commit #1 (2023-07-31)]
* [https://github.com/WebKit/WebKit/commit/39476b8c83f0ac6c9a06582e4d8e5aef0bb0a88f Patch commit #2 (2023-05-01)]
* [https://www.zerodayinitiative.com/blog/2018/4/12/inverting-your-assumptions-a-guide-to-jit-comparisons Inverting Your Assumptions: A Guide to JIT Comparisons by Jasiel Spelman (2018-04-12)]


==== Bug Description ====
==== Bug Description ====
There is an integer underflow in WebKit renderer. It was addressed with improved input validation.
According to abc (anonymous):
 
"The clobber bug PoC turns out not to be a memory corruption. Just like the article said, you can access a `GetterSetter` directly. The crash came from triggering `GetterSetter`'s methods that will call `RELEASE_ASSERT()`. We actually came across a bug that can leak `GetterSetter`s at WebKit's git main branch: `ceb7e89febcd [JSC] get_by_id_with_this + ProxyObject can leak JSScope objects https://bugs.webkit.org/show_bug.cgi?id=267425 <rdar://120777816>`
The JavaScriptCore Isel SBFX patterns in JavaScriptCore/b3/B3LowerToAir.cpp allowed immediate overflow as 'lsb' and 'width' are not properly checked.
<br />
 
In summary with tinkering with this bug, we do not think you can do anything useful with accessing a `GetterSetter`. The clobber bug however does allow setting properties in places where you usually cannot like `Function's prototype` in the article. But without JIT, we do not think you can cause any memory corruption. The impact for both bugs is probably just JS execution, which we already have, which is a no go in some context (JS injection) but it does not help in gaining PS4/PS5 usermode execution.
SBFX stands for Signed Bitfield Extract. See [https://www.scs.stanford.edu/~zyedidia/arm64/sbfx_sbfm.html] and [https://developer.arm.com/documentation/101273/0001/The-Cortex-M55-Instruction-Set--Reference-Material/Bit-field-instructions/SBFX-and-UBFX]. SBFX is an alias for SBFM (Signed Bitfield Move). See [https://www.scs.stanford.edu/~zyedidia/arm64/sbfm.html]. SBFM is a bitfield extraction opcode.
<br />
 
Note that the PS4 webbrowser JIT has been removed around PS4 System Software version 5.00 or lower so using the article is not applicable."
Isel is a short name for Instruction SELect. This pass transforms generic machine instructions into equivalent target-specific instructions. It traverses the MachineFunction bottom-up, selecting uses before definitions, enabling trivial dead code elimination.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/WebKit/WebKit/blob/main/JSTests/stress/sbfx-offset-overflow.js Vulnerability test by Justin Michaud]
* [https://medium.com/@enki-techblog/ios-16-5-1-safari-rce-analysis-cve-2023-37450-89bb8583bebc PoC by ENKI (2024-06-03)]


==== Patched ====
==== Patched ====
'''Yes''' on PS4 FW 12.00 and PS5 FW ?10.00?.
'''Yes''' on PS4 FW 11.50 and PS5 FW 9.00.


==== Tested ====
Tested working on PS4 FWs 10.00-11.02 and PS5 FWs 6.00-8.60. PS4 FWs <= ?9.60? and PS5 FWs <= ?5.50? are invulnerable.
Tested working on PS4 FWs 11.50 and PS5 FWs ?6.00-9.60?. Not working on PS4 <= 9.00 and PS5 >= 10.01.
 
----
=== FW 6.00-9.60 - FrameLoader::loadInSameDocument() UaF (CVE-2022-22620) leading to arbitrary RW ===
 
=== FW ?10.00?-11.52 - Unknown heap and string overflow (no CVE) leading to crash ===


==== Credits ====
==== Credits ====
* Debty for PoC public disclose (2024-08-29)
* Sergei Glazunov, Google Project Zero, for reporting the bug in 2013-01 and answering Maddie Stone's questions in 2022 (2013)
* Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2022-06-14)
* Abc (anonymous person) for making an OOM PoC for webkit-gtk, PS4 and PS5 (2023-10-03) then making an arbitrary RW PoC (PSFree) for webkit-gtk, PS4 6.00-9.60 and PS5 1.00-5.50 (2023-10-24)
* CelesteBlue for testing and porting abc' PSFree to PS4 6.00-9.60 and PS5 1.00-5.50 (2023-11-04)


==== Analysis ====
==== Analysis ====
* [https://github.com/Debvt/Wm/tree/Root0 PoC and analysis by Debty (2024-08-29)]
* [https://github.com/WebKit/WebKit/commit/aa31b6b4d09b09acdf1cec11f2f7f35bd362dd0e WebKit bug-reintroducing commit by Darin Adler reviewed by Alex Christensen (2016-12-31)]
* [https://bugs.webkit.org/show_bug.cgi?id=235551 WebKit fix talk by Yusuke Suzuki reviewed by Mark Lam (2022-01-24)]
* [https://github.com/WebKit/WebKit/commit/486816dc355c19f1de1b8056f85d0bbf7084dd6e WebKit fix commit by Yusuke Suzuki reviewed by Mark Lam (2022-01-25)]
* [https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22620.html Short writeup by Maddie Stone (2022-06-14)]
* [https://googleprojectzero.blogspot.com/2022/06/an-autopsy-on-zombie-in-wild-0-day.html Detailed writeup by Maddie Stone (2022-06-14)]


==== Bug Description ====
==== Bug Description ====
* TODO
The History API allows access to (and modification of) a stack of the pages visited in the current frame, and these page states are stored as a <code>SerializedScriptValue</code>. The History API exposes a getter for state, and a method <code>replaceState()</code> which allows overwriting the "most recent" history entry.


Implementation description by Debty:<br />
The bug is that <code>FrameLoader::loadInSameDocument()</code> takes the state as an argument (<code>stateObject</code>), but does not increase its reference count. Only a <code>HistoryItem</code> object holds a reference to the <code>stateObject</code>. <code>loadInSameDocument()</code> can trigger a callback into user JavaScript through the <code>onblur</code> event. The user's callback can call <code>replaceState()</code> to replace the <code>HistoryItem</code>'s state with a new object, therefore dropping the only reference to the <code>stateObject</code>. When the callback returns, <code>loadInSameDocument()</code> will still use this free'd object in its call to <code>statePopped()</code>, leading to the use-after-free.
String exploit is not actually an exploit but just a memory exhauster. It is not actually viable so instead there is a feature called "latest iteration".


==== Exploit Implementation ====
When <code>loadInSameDocument()</code> is called it changes the focus to the element its scrolling to. If we set the focus on a different element prior to <code>loadInSameDocument()</code>'s execution, the blur event will be fired on that element. Then we can free the <code>stateObject</code> by calling <code>replaceState()</code> in the <code>onblur</code> event handler.
* [https://github.com/Debvt/Wm/tree/Root0 PoC by Debty (2024-08-29)]


==== Patched ====
The bug is triggered by <code>history.back()</code> with the target state whose URL contains a hash. Here's a Proof-of-Concept that will crash:
'''Yes''' on PS4 FW 12.00 and PS5 FW 10.00.
<source lang="js">
input = document.body.appendChild(document.createElement('input'));


==== Tested ====
foo = document.body.appendChild(document.createElement('a'));
Tested working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.
foo.id = 'foo';
----


=== FW ?6.00-11.52? - Integer underflow in JSC genericTypedArrayViewProtoFuncCopyWithin (CVE-2023-38600) ===
function pop(event) {
    alert('you get a crash after you close this alert');
    event.state; // use the freed SerializedScriptValue
    alert('WebKit version not vulnerable');
}


==== Credits ====
addEventListener('popstate', pop);
* anonymous researcher for discovering the vulnerability and reporting it to Zero Day Initiative (2023-05)
* Yusuke Suzuki and Mark Lam for fixing the bug in WebKit (2023-07-31)
* Hossein Lotfi for publishing a writeup (2023-10-18)


==== Analysis ====
history.pushState('state1', '', location + '#foo'); // URL with a hash
* [https://www.zerodayinitiative.com/blog/2023/10/17/cve-2023-38600-story-of-an-innocent-apple-safari-copywithin-gone-way-outside Writeup by Hossein Lotfi (2023-10-18)]
history.pushState('state2', '');
* [https://github.com/WebKit/WebKit/commit/6e7e654417b61630d67f02b65798439cf3d6b0b5 WebKit fix commit by Yusuke Suzuki (2023-07-31)]


==== Bug Description ====
setTimeout(() => {
It is required to recompute length properly when resize happens during TypedArray copyWithin.
    input.focus();
    input.onblur = () => {
        history.replaceState('state3', '')
    };
    setTimeout(() => {
        history.back(); // trigger loadInSameDocument()
    }, 1000);
}, 1000);


copyWithin's side effectful operation can resize resizable ArrayBuffer. WebKit has a code catching this and recompute the appropriate copy count again, but it can overflow if `to` or `from` are larger than the newly updated `length`. The patch handles this case correctly: returning since there is no copying content in this case.
</source>
The user may then trigger a double free and escalate it into an arbitrary read primitive via spraying <code>WTF::StringImpl</code>s like in the <code>buildBubbleTree()</code> UaF exploit. The read primitive is used to create the <code>addrof()</code> primitive and is used to save addresses of buffers that will be used to modify a <code>SerializedScriptValue</code>. After freeing the StringImpl (triple free), <code>SerializedScriptValue</code>s are sprayed via the <code>postMessage()</code> JavaScript function until one is allocated using the previously freed memory.


The issue was patched by aborting the copy if either of the two variables to or from is larger than the updated length.
The method used to modify the fields of the <code>StringImpl</code> for arbitrary reads can be used can also be used to modify the <code>SerializedScriptValue</code>. Appropriate fields can modified to have deserialization create a <code>JSC::JSArrayBufferView</code> whose <code>m_vector</code> field will point to another <code>JSArrayBufferView</code>, which  will be called the worker. The user can modify the worker's fields for arbitrary read/write. Deserialization is done via <code>msg.data</code> where <code>msg</code> is the <code>MessageEvent</code> from <code>postMessage()</code>.


The values used during the exploit were sane as they went through a sanitizer function. However, in the final stage, the values were updated without checking if there are inside the buffer length bounds.
A way to know if the system is vulnerable is the appearance of the input HTML element in the PoC page. If the HTML input field stays focused (blue outline) after the second timeout, then the vulnerability is not present. Note that Maddie Stone's PoC will never trigger any sort of crash on release builds as it was meant for builds with memory sanitation that can detect UaFs.
 
According to PS4 WebKit source code for System Software version 11.00, not only it is not patched but it uses code from 2021! Looking at [https://github.com/WebKit/WebKit/blob/cccb58deac3c56a831678458ce95ea5b7c837614/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h#L177 a version close to one in the PS4 source code for System Software version 11.00], it should be exploitable.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://gist.github.com/zdi-team/ad320bdc6ad095cc210c7031e0f0ecda/raw/746ce622fe73344ccb9cd51bc03ad97950f4ea3b/CVE-2023-38600-0.js Minimal PoC by Hossein Lotfi (2023-10-18)]
* Simple PoC for ASAN webkit-gtk by Maddie Stone in Maddie Stone's writeups
* [https://github.com/WebKit/WebKit/blob/main/JSTests/stress/resizable-array-buffer-copy-within-length-update.js Vulnerability test code by Yusuke Suzuki (2023-07-31)]
* [https://github.com/springsec/CVE-2022-22620/blob/main/CVE-2022-22620_infoleak_exploit.html Information leak PoC for webkit-gtk by springsec]
* [https://discord.com OOM PoC for PS4 and PS5 by abc on ps4-dev discord (to mirror)]
* [https://discord.com Arbitrary RW PoC (PSFree) for PS4 6.00-9.60 and PS5 1.00-5.50 by abc on ps4-dev discord (to mirror)]


==== Patched ====
==== Patched ====
'''Maybe''' in FW 11.50.
'''Yes''' on PS4 FW 10.00 and PS5 FW 6.00.
 
The patch changes the stateObject argument to loadInSameDocument from a raw pointer, SerializedScriptValue*, to a reference-counted pointer, RefPtr<SerializedScriptValue>, so that loadInSameDocument now increments the reference count on the object.


==== Tested ====
Tested working on PS4 FWs 6.00-9.60 and PS5 FWs 1.00-5.50. PS4 FWs <= 5.56 are invulnerable as the HTML input field stays focused (blue outline) after second timeout whilst it should not if the console were exploitable.
Not tested yet on PS4 nor PS5. To test on PS4 11.00.
 
----
=== FW 9.00-9.04 - WebCore::CSSFontFaceSet vulnerabilities leading to arbitrary RW ===


=== FW ?10.00-11.02? - JSC::DFG::clobberize() needs to be more precise with the *ByOffset nodes (CVE-2023-41993) leading to arbitrary RW ===
There are many FontFaceSet vulnerabilities. Explore [https://trac.webkit.org/search?q=mmaxfield%40apple.com+FontFaceSet&noquickjump=1&changeset=on].


==== Credits ====
==== Credits ====
* Bill Marczak of The Citizen Lab at The University of Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group for discoverting the vulnerability and reporting it (2023-09-21)
* Myles C. Maxfield (litherum), Apple, for adding the vulnerability in WebKit (2016-02-22) then fixing and so disclosing the vulnerability (2021-08-26)
* Keith Miller for the WebKit fix commit (2023-10-09)
* Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2021-10-13)
* po6ix for his writeup (2023-10-15)
* PS Test discord server community for testing PoCs of many WebKit vulnerabilities on their PS4s (2021-10-13)
* sleirsgoevy for making the first exploit PoC for Safari (2021-10-24) and the first exploit PoC for PS4 FW 9.00-9.04 and PS5 FW 3.00-4.50 (2021-10-27)


==== Analysis ====
==== Analysis ====
* [https://github.com/WebKit/WebKit/commit/08d5d17c766ffc7ca6a7c833c5720eb71b427784 WebKit fix commit by Keith Miller (2023-10-09)]
* [https://github.com/WebKit/WebKit/commit/d5dbfd02054e9f904b27224a598ca1bb8ded5f87 WebKit bug-introducing commit by Myles C. Maxfield - r256659 (2016-02-22)]
* [https://github.com/po6ix/POC-for-CVE-2023-41993 Writeup by po6ix (2023-10-15)]
* [https://trac.webkit.org/changeset/281648/webkit WebKit fix commit by Myles C. Maxfield - r281648 (2021-08-26)]
 
* [https://github.com/WebKit/WebKit/commit/b22be72a013442ca9d1ff4bf3aa8aa436f78f142 WebKit commit adding FontFace tests (2021-09-01)]
==== Bug Description ====
* [https://bugs.webkit.org/show_bug.cgi?id=229848 WebKit Bugzilla - Bug 229848 - FontFaceSet.has() needs to react to style changes by Myles C. Maxfield (2021-09-02)]
clobberize needs to be more precise with the *ByOffset nodes. CSE phase uses clobberize to figure out if it's safe to merge two operations that def the same HeapLocation. Since HeapLocation does not currently have a way to track the offset used by the various *ByOffset nodes it can get confused and think that two ByOffset instructions produce the same value even if they do not use the same offset. This patch solves this by adding a new field to HeapLocation, which takes the metadata associated with the corresponding *ByOffset node. If two *ByOffset operations don't share the same metadata then they cannot be CSEed.
* [https://github.com/web-platform-tests/wpt/pull/30322#issue-726455679 web-platform-tests - Add a test for FontFaceSet.has() #30322 (2021-09-03)]
 
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1729089#c4 Mozilla Bugzilla - New wpt failures in /css/css-font-loading/fontfaceset-has.html (with TypeError `fonts.keys() is not iterable`, due to FontFaceSetIterator not behaving like an Iterable) (2021-09-03)]
This vulnerability is ranked 7.5 (HIGH) on CVSS:3.1.
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1729997 Mozilla Bugzilla - FontFaceSet's iterators skip items when previous items are removed by Myles C. Maxfield (2021-09-09)]
* [https://bugs.webkit.org/show_bug.cgi?id=230119 WebKit Bugzilla - Bug 230119 - FontFaceSet's iterators skip items when previous items are removed by Myles C. Maxfield (2021-09-09)]
* [https://github.com/WebKit/WebKit/commit/fbf37d27e313d8d0a150a74cc8fab956eb7f3c59 WebKit fix commit by Myles C. Maxfield merged by Russell Epstein (2021-09-09)]
* [https://github.com/WebKit/WebKit/blob/74bd0da94fa1d31a115bc4ee0e3927d8b2ea571e/Source/WebCore/css/CSSFontFaceSet.cpp#L223 Part of vulnerable code]
* [https://web.archive.org/web/20211020134808/https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-30858.html (archive) Write-up and PoC by Maddie Stone (2021-10-13)]. Maddie Stone's vulnerability is not CVE-2021-30858 but instead might be CVE-2021-30889. See [https://github.com/googleprojectzero/0days-in-the-wild/commit/65fcdf0473ada4e80dc967662ea8f3f3ce4ea81e#diff-1a428c43cedcf140e5bd6f92e4527f169c3c717780e1586f2fab589e4f467b52 write-up edit commit]. Warning: Maddie Stone's vulnerability was wrongly classified as a use-after-free by Maddie Stone according to sleirsgoevy.
* [https://wololo.net/2021/10/14/use-after-free-webkit-vulnerability-impacts-ps4-possibly-up-to-firmware-9-00-included/ Vulnerability description by Wololo (2021-10-14)]


This vulnerability should provide r/w primitive to the webcontent process, but currently the PoC is written only up to addrof/fakeobj.
==== Bug Description ====
Description in WebKit fix commit by Myles C. Maxfield:


==== Exploit Implementation ====
After r256659, asking for a failed CSSFontFace's families() returns nullopt. It is possible to add a failed font to a CSSFontFaceSet (of course). When we do that, we recognize the font is failed and do not update our internal data structures, because there's no need to - we cannot do anything useful with a failed font. If you _then_ try to remove the font from the CSSFontFace, we do not call families(), but instead just pull out the raw m_families member, and look in our internal data structures for it, but we do not find it, because it was never added.
* [https://github.com/po6ix/POC-for-CVE-2023-41993 PoC written only up to addrof/fakeobj by po6ix (2023-10-15)]


==== Patched ====
Description in Maddie Stone's write-up:
'''Maybe''' on PS4 FW 12.00 and PS5 ?10.00?


==== Tested ====
The vulnerability is a use-after-free due to an unchecked end() iterator. There was an assert statement: ASSERT(iterator != m_facesLookupTable.end());, but ASSERTs do not do anything in release builds. Therefore, even if iterator == m_facesLookupTable.end() in the release build, nothing would happen and iterator would still be used. In FontFaceSet a FontFace is not added to the faces lookup table in addToFacesLookupTable if the font has already been deemed to be invalid. However, removeFromFacesLookupTable would still attempt to remove the font, leading to the use-after-free. The patch changes the ASSERT to an if clause. The function will return if iterator == m_facesLookupTable.end(), since the item it wishes to remove is not found in the table.
Not tested yet. According to open source code, PS4 FW 11.00 should be vulnerable.
----


=== FW 10.00-11.02 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to crash ===
Description by sleirsgoevy:


==== Credits ====
On PS4 FWs 9.00-9.04 the constructor returns with an exception, but to C++ code that ignores it. That is how an invalid font is created in the first place. On earlier PS4 FWs the exception is propagated to JavaScript.
* Alexey Shvayka for vulnerability discovery and fixes in WebKit (2023-05-01)
* ENKI for public disclose and writeup (2024-06-03)
* abc (anonymous) for tests and analysis (2024-10-01)


==== Analysis ====
==== Exploit Implementation ====
* [https://medium.com/@enki-techblog/ios-16-5-1-safari-rce-analysis-cve-2023-37450-89bb8583bebc Analysis by ENKI (2024-06-03)]
* [https://web.archive.org/web/20211024215236/http://vdsina.sleirsgoevy.dynv6.net:8081/ (archive) First exploit PoC for Safari by sleirsgoevy (2021-10-24)]
* [https://github.com/WebKit/WebKit/commit/1b0741f400ee2d31931ae30f2ddebe66e8fb0945 Patch commit #1 for vulnerability detection (2023-07-31)]
* [https://gist.github.com/sleirsgoevy/6beca32893909095f4bba1ce29167992 First exploit PoC for PS4 FW 9.00-9.04 and PS5 FW 3.00-4.51 by sleirsgoevy (2021-10-27)]
* [https://github.com/WebKit/WebKit/commit/39476b8c83f0ac6c9a06582e4d8e5aef0bb0a88f Patch commit #2 (2023-05-01)]
* [https://github.com/ChendoChap/pOOBs4/blob/main/webkit.js Implementation for PS4 FW 9.00 with exFAT kernel exploit in pOOBs4 by ChendoChap (2022-01-17)]
* [https://www.zerodayinitiative.com/blog/2018/4/12/inverting-your-assumptions-a-guide-to-jit-comparisons Inverting Your Assumptions: A Guide to JIT Comparisons by Jasiel Spelman (2018-04-12)]


==== Bug Description ====
==== Patched ====
Note that the PS4 web browser JIT support has been removed since around PS4 System Software version 5.00 or lower so using the article directly is not applicable.
'''Yes''' on PS4 FW 9.50 and '''No''' as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00). Not working on PS4 FWs <9.00 and PS5 FWs <2.10.


The clobber bug PoC turns out not to be a memory corruption. Just like the article said, you can access a `GetterSetter` directly. The crash came from triggering `GetterSetter`'s methods that will call `RELEASE_ASSERT()`.
Might have been introduced in PS4 FW 3.50 and before PS5 FW 1.00 according to dates (need to check). However the vulnerability cannot be exploited in some conditions depending on how WebKit was compiled. For example, on PS4 FWs 7.55-8.52 and PS5 FWs <= 2.00, the FontFaceSet constructor returns with an exception that is propagated to JavaScript, preventing exploitation this way.


We actually have [[#FW_?6.00-11.52?_-_get_by_id_with_this_associated_with_ProxyObject_can_leak_JSScope_objects|a bug that can leak `GetterSetter`s]].
Tested working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00.


In summary with tinkering with this bug, abc (anonymous) do not think that an attacker can do anything useful with accessing a `GetterSetter`. The clobberWorld bug however does allow setting properties in places where you usually cannot like `Function's prototype` as shown in the article. But without JIT, one probably cannot cause any memory corruption. The impact for both bugs (clobberWorld and ProxyObject) is probably just JavaScript execution, which we already have, which is a no go in some context (JS injection) but it does not help in gaining usermode ROP execution on PS4 or PS5.
=== FW 6.00-7.55 - WebCore::ValidationMessage::buildBubbleTree() UaF leading to arbitrary RW ===


==== Exploit Implementation ====
==== Credits ====
* [https://medium.com/@enki-techblog/ios-16-5-1-safari-rce-analysis-cve-2023-37450-89bb8583bebc PoC by ENKI (2024-06-03)]
* Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) who are Security Researcher at Synacktiv for fuzzing WebKit, finding a way to exploit the vulnerability on PS4, presenting it on Black Hat Europe 2020 ([https://www.blackhat.com/eu-20/briefings/schedule/index.html#this-is-for-the-pwners--exploiting-a-webkit--day-in-playstation--21212]) and sharing the code (2020-12-10)
* sleirsgoevy for porting (although with low success rate) to PS4 FWs 7.00-7.02


==== Patched ====
==== Analysis ====
'''Yes''' on PS4 FW 11.50 and PS5 FW 9.00.
* [https://github.com/WebKit/WebKit/commit/b99f0737d0bbcbc52c4b6e6edadcf4990173191f WebKit bad fix commit (2019-05-28)]
* [https://github.com/WebKit/WebKit/commit/b5d5412d9f517e25304aadb1b20dd5118a2c387d WebKit good fix commit (2020-09-11)]
* [https://www.synacktiv.com/publications/this-is-for-the-pwners-exploiting-a-webkit-0-day-in-playstation-4.html Write-up by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)]
* [http://i.blackhat.com/eu-20/Thursday/eu-20-Meffre-This-Is-For-The-Pwners-Exploiting-A-Webkit-0day-In-Playstation4.pdf Presentation slides by by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)]


==== Tested ====
==== Bug Description ====
Tested working on PS4 FWs 10.00-11.02 and PS5 FWs 6.00-8.60. PS4 FWs <= ?9.60? and PS5 FWs <= ?5.50? are invulnerable.
* The method buildBubbleTree makes a call to update the layout during which all user registered JS handlers are executed. If the ValidationMessage is destroyed in a JS callback, this could lead to a Use-After-Free situation when we get back to buildBubbleTree code.
----


=== FW 6.00-9.60 - FrameLoader::loadInSameDocument() UaF (CVE-2022-22620) leading to arbitrary RW ===
* ValidationMessage::buildBubbleTree is doing layout which can run a script detaching the owner form element, and this ValidationMessage object can be destroyed.


==== Credits ====
After private disclose by Synacktiv ethical hackers, the vulnerability was fixed in WebKit on September 11st 2020. SIE updated to the patched WebKit with firmware 8.00 released on October 14st 2020.
* Sergei Glazunov, Google Project Zero, for reporting the bug in 2013-01 and answering Maddie Stone's questions in 2022 (2013)
* Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2022-06-14)
* abc (anonymous) for making an OOM PoC for webkit-gtk, PS4 and PS5 (2023-10-03) then making an arbitrary RW PoC (PSFree) for webkit-gtk, PS4 6.00-9.60 and PS5 1.00-5.50 (2023-10-24)
* CelesteBlue for testing and porting abc' PSFree to PS4 6.00-9.60 and PS5 1.00-5.50 (2023-11-04)


==== Analysis ====
==== Exploit Implementation ====
* [https://github.com/WebKit/WebKit/commit/aa31b6b4d09b09acdf1cec11f2f7f35bd362dd0e WebKit bug-reintroducing commit by Darin Adler reviewed by Alex Christensen (2016-12-31)]
* [https://github.com/synacktiv/PS4-webkit-exploit-6.XX Initial 6.xx implementation by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-11-12]
* [https://bugs.webkit.org/show_bug.cgi?id=235551 WebKit fix talk by Yusuke Suzuki reviewed by Mark Lam (2022-01-24)]
* [https://github.com/sleirsgoevy/PS4-webkit-exploit-7.02 7.02 implementation with code execution by sleirsgoevy (2020-12-15)]
* [https://github.com/WebKit/WebKit/commit/486816dc355c19f1de1b8056f85d0bbf7084dd6e WebKit fix commit by Yusuke Suzuki reviewed by Mark Lam (2022-01-25)]
* [https://github.com/sleirsgoevy/ps4jb 6.72-7.02 Kernel exploit using this WebKit exploit by sleirsgoevy (2020-12-16)]
* [https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22620.html Short writeup by Maddie Stone (2022-06-14)]
* [https://github.com/ChendoChap/ps4-ipv6-uaf/tree/7.00-7.02 7.00-7.02 Kernel exploit using this WebKit exploit by ChendoChap (2020-12-16)]
* [https://googleprojectzero.blogspot.com/2022/06/an-autopsy-on-zombie-in-wild-0-day.html Detailed writeup by Maddie Stone (2022-06-14)]


==== Bug Description ====
==== Patched ====
The History API allows access to (and modification of) a stack of the pages visited in the current frame, and these page states are stored as a <code>SerializedScriptValue</code>. The History API exposes a getter for state, and a method <code>replaceState()</code> which allows overwriting the "most recent" history entry.
'''Yes''' in 8.00 FW. Tested working on FWs 6.00-7.55, not working on FWs <= 5.56. HTML textarea guessed addresses for FWs 6.70-7.55 are known but not for FWs 6.00-6.51 so an attacker needs to make tests to determine these addresses on FWs 6.00-6.51.


The bug is that <code>FrameLoader::loadInSameDocument()</code> takes the state as an argument (<code>stateObject</code>), but does not increase its reference count. Only a <code>HistoryItem</code> object holds a reference to the <code>stateObject</code>. <code>loadInSameDocument()</code> can trigger a callback into user JavaScript through the <code>onblur</code> event. The user's callback can call <code>replaceState()</code> to replace the <code>HistoryItem</code>'s state with a new object, therefore dropping the only reference to the <code>stateObject</code>. When the callback returns, <code>loadInSameDocument()</code> will still use this free'd object in its call to <code>statePopped()</code>, leading to the use-after-free.
=== FW 6.00-6.72 - bad_hoist Type Confusion exploit (CVE-2018-4386) leading to arbirary RW ===


When <code>loadInSameDocument()</code> is called it changes the focus to the element its scrolling to. If we set the focus on a different element prior to <code>loadInSameDocument()</code>'s execution, the blur event will be fired on that element. Then we can free the <code>stateObject</code> by calling <code>replaceState()</code> in the <code>onblur</code> event handler.
==== Credits ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Sep 13, 2018)
* Fire30 for turning the vulnerability into exploit for PS4 (Dec 30, 2019)
* sleirsgoevy for attempting to stabilize the PS4 exploit with a new implementation (Feb 23, 2020)


The bug is triggered by <code>history.back()</code> with the target state whose URL contains a hash. Here's a Proof-of-Concept that will crash:
==== Analysis ====
<source lang="js">
* https://bugs.chromium.org/p/project-zero/issues/detail?id=1665
input = document.body.appendChild(document.createElement('input'));
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4386
* https://packetstormsecurity.com/files/155871/Sony-Playstation-4-Webkit-Code-Execution.html
* https://twitter.com/Fire30_/status/1211775229116211200


foo = document.body.appendChild(document.createElement('a'));
==== Bug Description ====
foo.id = 'foo';
WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary does not invalidate the ForInContext object.


function pop(event) {
It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated.
    alert('you get a crash after you close this alert');
    event.state; // use the freed SerializedScriptValue
    alert('WebKit version not vulnerable');
}


addEventListener('popstate', pop);
This is a Type Confusion exploit.


history.pushState('state1', '', location + '#foo'); // URL with a hash
==== Exploit Implementation ====
history.pushState('state2', '');
* [https://github.com/Fire30/bad_hoist Initial implementation by Fire30]
* [https://github.com/sleirsgoevy/bad_hoist Implementation with code execution by sleirsgoevy]


setTimeout(() => {
==== Patched ====
    input.focus();
'''Yes''' in 7.00 FW
    input.onblur = () => {
----
        history.replaceState('state3', '')
 
    };
=== FW 4.50-6.72 - DOMWindow::open heap UaF (CVE-2021-30849) leading to crash ===
    setTimeout(() => {
        history.back(); // trigger loadInSameDocument()
    }, 1000);
}, 1000);


</source>
==== Credits ====
The user may then trigger a double free and escalate it into an arbitrary read primitive via spraying <code>WTF::StringImpl</code>s like in the <code>buildBubbleTree()</code> UaF exploit. The read primitive is used to create the <code>addrof()</code> primitive and is used to save addresses of buffers that will be used to modify a <code>SerializedScriptValue</code>. After freeing the StringImpl (triple free), <code>SerializedScriptValue</code>s are sprayed via the <code>postMessage()</code> JavaScript function until one is allocated using the previously freed memory.
* Sergei Glazunov (from Google Project Zer0) for the exploit PoC (Jul 1, 2021)


The method used to modify the fields of the <code>StringImpl</code> for arbitrary reads can be used can also be used to modify the <code>SerializedScriptValue</code>. Appropriate fields can modified to have deserialization create a <code>JSC::JSArrayBufferView</code> whose <code>m_vector</code> field will point to another <code>JSArrayBufferView</code>, which  will be called the worker. The user can modify the worker's fields for arbitrary read/write. Deserialization is done via <code>msg.data</code> where <code>msg</code> is the <code>MessageEvent</code> from <code>postMessage()</code>.
==== Analysis ====
* https://bugs.chromium.org/p/project-zero/issues/detail?id=2204


A way to know if the system is vulnerable is the appearance of the input HTML element in the PoC page. If the HTML input field stays focused (blue outline) after the second timeout, then the vulnerability is not present. Note that Maddie Stone's PoC will never trigger any sort of crash on release builds as it was meant for builds with memory sanitation that can detect UaFs.
==== Bug Description ====


==== Exploit Implementation ====
==== Exploit Implementation ====
* Simple PoC for ASAN webkit-gtk by Maddie Stone in Maddie Stone's writeups
* [https://github.com/springsec/CVE-2022-22620/blob/main/CVE-2022-22620_infoleak_exploit.html Information leak PoC for webkit-gtk by springsec]
* [https://discord.com OOM PoC for PS4 and PS5 by abc on ps4-dev discord (to mirror)]
* [https://discord.com Arbitrary RW PoC (PSFree) for PS4 6.00-9.60 and PS5 1.00-5.50 by abc on ps4-dev discord (to mirror)]


==== Patched ====
==== Patched ====
'''Yes''' on PS4 FW 10.00 and PS5 FW 6.00.
'''Yes''' in 7.00 FW. Vulnerable on PS4 FWs 4.50-6.72. Not vulnerable on FWs <= 4.07. Not vulnerable on FWs >=7.00 according to manual tests but need to check WebKit sources.
----


The patch changes the stateObject argument to loadInSameDocument from a raw pointer, SerializedScriptValue*, to a reference-counted pointer, RefPtr<SerializedScriptValue>, so that loadInSameDocument now increments the reference count on the object.
=== FW 4.50-6.20 - JSArray::shiftCountWithArrayStorage() OOB RW (CVE-2018-4441) leading to arbitrary RW ===


==== Tested ====
==== Credits ====
Tested working on PS4 FWs 6.00-9.60 and PS5 FWs 1.00-5.50. PS4 FWs <= 5.56 are invulnerable as the HTML input field stays focused (blue outline) after second timeout whilst it should not if the console were exploitable.
* Lokihardt (from Google Project Zer0) for the exploit PoC (Oct 3, 2018)
----
* Specter for the rewriting for PS4 (Mar 8, 2019)
* St4rk for helping Specter


=== FW 9.00-9.04 - WebCore::CSSFontFaceSet vulnerabilities leading to arbitrary RW ===
==== Analysis ====
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1685 Bug report by Lokihardt (Oct 3, 2018)]
* [https://github.com/WebKit/webkit/commit/51a62eb53815863a1bd2dd946d12f383e8695db0 WebKit fix commit (Oct 15, 2018)]
* [https://mastodon.social/@buherator/101654714198519755 Announce of incoming write-up by rkmylo and buherator/stratan/@5tratan, Meligra Team (Feb 25, 2019)]
* [https://rstforums.com/forum/topic/110439-cve-2018-4441-oob-rw-via-jsarrayunshiftcountwitharraystorage-webkit/ Write-up mirrored by Nytro (Feb 27, 2019)]


There are many FontFaceSet vulnerabilities. Explore [https://trac.webkit.org/search?q=mmaxfield%40apple.com+FontFaceSet&noquickjump=1&changeset=on].
==== Bug Description ====
We would take the fast path for JSArray::shiftCountWithArrayStorage when the array hasHoles(). However, the code for this was wrong. It would incorrectly update ArrayStorage::m_numValuesInVector.


==== Credits ====
==== Exploit Implementation ====
* Myles C. Maxfield (litherum), Apple, for adding the vulnerability in WebKit (2016-02-22) then fixing and so disclosing the vulnerability (2021-08-26)
* [https://github.com/Cryptogenic/PS4-6.20-WebKit-Code-Execution-Exploit PS4 6.20 WebKit exploit by Specter]
* Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2021-10-13)
 
* PS Test discord server community for testing PoCs of many WebKit vulnerabilities on their PS4s (2021-10-13)
==== Patched ====
* sleirsgoevy for making the first exploit PoC for Safari (2021-10-24) and the first exploit PoC for PS4 FW 9.00-9.04 and PS5 FW 3.00-4.50 (2021-10-27)
'''Yes''' in 6.50 FW. It does not work on <= 4.07 FW PS4 according to tests as the exploit fails at step "Triggering memory corruption".
----
 
=== FW 6.00-6.20 - JSC::arrayProtoPrivateFuncConcatMemcpy() Information Leak (CVE-2018-4358) ?leading to ASLR defeat? ===
 
==== Credits ====
* bkth, niklasb and saelo (from phoenhex Team) for the exploit PoC in Safari (Sep 26, 2018)
* Vultra for discovering that the exploit worked on PS4 FW 6.00 (Dec 10, 2018)


==== Analysis ====
==== Analysis ====
* [https://github.com/WebKit/WebKit/commit/d5dbfd02054e9f904b27224a598ca1bb8ded5f87 WebKit bug-introducing commit by Myles C. Maxfield - r256659 (2016-02-22)]
* Related: https://bugs.chromium.org/p/project-zero/issues/detail?id=1032
* [https://trac.webkit.org/changeset/281648/webkit WebKit fix commit by Myles C. Maxfield - r281648 (2021-08-26)]
* Related: https://doar-e.github.io/blog/2018/07/14/cve-2017-2446-or-jscjsglobalobjectishavingabadtime/
* [https://github.com/WebKit/WebKit/commit/b22be72a013442ca9d1ff4bf3aa8aa436f78f142 WebKit commit adding FontFace tests (2021-09-01)]
* https://github.com/WebKit/webkit/commit/b68b373dcbfbc68682ceeca8292c5c0051472071
* [https://bugs.webkit.org/show_bug.cgi?id=229848 WebKit Bugzilla - Bug 229848 - FontFaceSet.has() needs to react to style changes by Myles C. Maxfield (2021-09-02)]
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4358
* [https://github.com/web-platform-tests/wpt/pull/30322#issue-726455679 web-platform-tests - Add a test for FontFaceSet.has() #30322 (2021-09-03)]
* https://phoenhex.re/2018-09-26/safari-array-concat
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1729089#c4 Mozilla Bugzilla - New wpt failures in /css/css-font-loading/fontfaceset-has.html (with TypeError `fonts.keys() is not iterable`, due to FontFaceSetIterator not behaving like an Iterable) (2021-09-03)]
* [https://bugzilla.mozilla.org/show_bug.cgi?id=1729997 Mozilla Bugzilla - FontFaceSet's iterators skip items when previous items are removed by Myles C. Maxfield (2021-09-09)]
* [https://bugs.webkit.org/show_bug.cgi?id=230119 WebKit Bugzilla - Bug 230119 - FontFaceSet's iterators skip items when previous items are removed by Myles C. Maxfield (2021-09-09)]
* [https://github.com/WebKit/WebKit/commit/fbf37d27e313d8d0a150a74cc8fab956eb7f3c59 WebKit fix commit by Myles C. Maxfield merged by Russell Epstein (2021-09-09)]
* [https://github.com/WebKit/WebKit/blob/74bd0da94fa1d31a115bc4ee0e3927d8b2ea571e/Source/WebCore/css/CSSFontFaceSet.cpp#L223 Part of vulnerable code]
* [https://web.archive.org/web/20211020134808/https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-30858.html (archive) Write-up and PoC by Maddie Stone (2021-10-13)]. Maddie Stone's vulnerability is not CVE-2021-30858 but instead might be CVE-2021-30889. See [https://github.com/googleprojectzero/0days-in-the-wild/commit/65fcdf0473ada4e80dc967662ea8f3f3ce4ea81e#diff-1a428c43cedcf140e5bd6f92e4527f169c3c717780e1586f2fab589e4f467b52 write-up edit commit]. Warning: Maddie Stone's vulnerability was wrongly classified as a use-after-free by Maddie Stone according to sleirsgoevy.
* [https://wololo.net/2021/10/14/use-after-free-webkit-vulnerability-impacts-ps4-possibly-up-to-firmware-9-00-included/ Vulnerability description by Wololo (2021-10-14)]


==== Bug Description ====
==== Bug Description ====
Description in WebKit fix commit by Myles C. Maxfield:


After r256659, asking for a failed CSSFontFace's families() returns nullopt. It is possible to add a failed font to a CSSFontFaceSet (of course). When we do that, we recognize the font is failed and do not update our internal data structures, because there's no need to - we cannot do anything useful with a failed font. If you _then_ try to remove the font from the CSSFontFace, we do not call families(), but instead just pull out the raw m_families member, and look in our internal data structures for it, but we do not find it, because it was never added.
==== Exploit Implementation ====
 
* [https://github.com/externalist/exploit_playground/blob/master/jsc_ConcatMemcpy_infoleak/ileak.html PoC for iOS]
Description in Maddie Stone's write-up:
* [https://github.com/Josephmh97/PS4_jsc_ConcatMemcpy_POC PoC for PS4]
 
The vulnerability is a use-after-free due to an unchecked end() iterator. There was an assert statement: ASSERT(iterator != m_facesLookupTable.end());, but ASSERTs do not do anything in release builds. Therefore, even if iterator == m_facesLookupTable.end() in the release build, nothing would happen and iterator would still be used. In FontFaceSet a FontFace is not added to the faces lookup table in addToFacesLookupTable if the font has already been deemed to be invalid. However, removeFromFacesLookupTable would still attempt to remove the font, leading to the use-after-free. The patch changes the ASSERT to an if clause. The function will return if iterator == m_facesLookupTable.end(), since the item it wishes to remove is not found in the table.
 
Description by sleirsgoevy:
 
On PS4 FWs 9.00-9.04 the constructor returns with an exception, but to C++ code that ignores it. That is how an invalid font is created in the first place. On earlier PS4 FWs the exception is propagated to JavaScript.
 
==== Exploit Implementation ====
* [https://web.archive.org/web/20211024215236/http://vdsina.sleirsgoevy.dynv6.net:8081/ (archive) First exploit PoC for Safari by sleirsgoevy (2021-10-24)]
* [https://gist.github.com/sleirsgoevy/6beca32893909095f4bba1ce29167992 First exploit PoC for PS4 FW 9.00-9.04 and PS5 FW 3.00-4.51 by sleirsgoevy (2021-10-27)]
* [https://github.com/ChendoChap/pOOBs4/blob/main/webkit.js Implementation for PS4 FW 9.00 with exFAT kernel exploit in pOOBs4 by ChendoChap (2022-01-17)]


==== Patched ====
==== Patched ====
'''Yes''' on PS4 FW 9.50 and '''No''' as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00). Not working on PS4 FWs <9.00 and PS5 FWs <2.10.
'''Yes''' in 6.50 FW
 
Might have been introduced in PS4 FW 3.50 and before PS5 FW 1.00 according to dates (need to check). However the vulnerability cannot be exploited in some conditions depending on how WebKit was compiled. For example, on PS4 FWs 7.55-8.52 and PS5 FWs <= 2.00, the FontFaceSet constructor returns with an exception that is propagated to JavaScript, preventing exploitation this way.


==== Tested ====
==== Tested ====
Tested working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00.
Works on 6.00-6.20. Not working on PS4 FWs <= 5.56 because JSC (JavaScriptCore) was too old.
----
----


=== FW 6.00-7.55 - WebCore::ValidationMessage::buildBubbleTree() UaF leading to arbitrary RW ===
=== FW 4.50-5.56 - JSGlobalObject::haveABadTime() Type Confusion (CVE-2017-7005) leading to arbitrary RW ===


==== Credits ====
==== Credits ====
* Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) who are Security Researcher at Synacktiv for fuzzing WebKit, finding a way to exploit the vulnerability on PS4, presenting it on Black Hat Europe 2020 ([https://www.blackhat.com/eu-20/briefings/schedule/index.html#this-is-for-the-pwners--exploiting-a-webkit--day-in-playstation--21212]) and sharing the code (2020-12-10)
* Lokihardt (from Google Project Zer0) for the exploit PoC (Mar 20, 2017)
* sleirsgoevy for porting (although with low success rate) to PS4 FWs 7.00-7.02
* ALEXZZZ9 for the first PS4 implementation (on 5.01), and at same time for burning the exploit (Feb 20, 2018)
* qwertyoruiop for rewriting and porting to 5.05 and 5.50


==== Analysis ====
==== Analysis ====
* [https://github.com/WebKit/WebKit/commit/b99f0737d0bbcbc52c4b6e6edadcf4990173191f WebKit bad fix commit (2019-05-28)]
[https://bugs.chromium.org/p/project-zero/issues/detail?id=1208 Project Zer0 Bug Description]
* [https://github.com/WebKit/WebKit/commit/b5d5412d9f517e25304aadb1b20dd5118a2c387d WebKit good fix commit (2020-09-11)]
* [https://www.synacktiv.com/publications/this-is-for-the-pwners-exploiting-a-webkit-0-day-in-playstation-4.html Write-up by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)]
* [http://i.blackhat.com/eu-20/Thursday/eu-20-Meffre-This-Is-For-The-Pwners-Exploiting-A-Webkit-0day-In-Playstation4.pdf Presentation slides by by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)]


==== Bug Description ====
==== Bug Description ====
* The method buildBubbleTree makes a call to update the layout during which all user registered JS handlers are executed. If the ValidationMessage is destroyed in a JS callback, this could lead to a Use-After-Free situation when we get back to buildBubbleTree code.
When JSGlobalObject::haveABadTime() is called with arrays of a different JSGlobalObject type, type confusion can occur, leading to memory corruption.
 
* ValidationMessage::buildBubbleTree is doing layout which can run a script detaching the owner form element, and this ValidationMessage object can be destroyed.
 
After private disclose by Synacktiv ethical hackers, the vulnerability was fixed in WebKit on September 11st 2020. SIE updated to the patched WebKit with firmware 8.00 released on October 14st 2020.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/synacktiv/PS4-webkit-exploit-6.XX Initial 6.xx implementation by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-11-12]
* [https://github.com/ALEXZZZ9/PS4-5.01-WebKit-Exploit-PoC]
* [https://github.com/sleirsgoevy/PS4-webkit-exploit-7.02 7.02 implementation with code execution by sleirsgoevy (2020-12-15)]
* [http://crack.bargains/550/ PS4 5.50 (WebKit Only)]
* [https://github.com/sleirsgoevy/ps4jb 6.72-7.02 Kernel exploit using this WebKit exploit by sleirsgoevy (2020-12-16)]
* [https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/master/expl.js]
* [https://github.com/ChendoChap/ps4-ipv6-uaf/tree/7.00-7.02 7.00-7.02 Kernel exploit using this WebKit exploit by ChendoChap (2020-12-16)]


==== Patched ====
==== Patched ====
'''Yes''' in 8.00 FW.
'''Yes''' in 6.00 FW
 
==== Tested ====
Tested working on FWs 6.00-7.55, not working on FWs <= 5.56. HTML textarea guessed addresses for FWs 6.70-7.55 are known but not for FWs 6.00-6.51 so an attacker needs to make tests to determine these addresses on FWs 6.00-6.51.
----
----


=== FW 6.00-6.72 - bad_hoist Type Confusion exploit (CVE-2018-4386) leading to arbirary RW ===
=== FW ?.??-4.05-5.56 - Document::adoptNode() UaF (CVE-2017-2468) leading to crash ===


==== Credits ====
==== Credits ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Sep 13, 2018)
* Lokihardt (from Google Project Zer0) for the exploit PoC (Jan 23, 2017)
* Fire30 for turning the vulnerability into exploit for PS4 (Dec 30, 2019)
* CelesteBlue for testing on PS4 and PS Vita (May 9, 2020)
* sleirsgoevy for attempting to stabilize the PS4 exploit with a new implementation (Feb 23, 2020)


==== Analysis ====
==== Analysis ====
* https://bugs.chromium.org/p/project-zero/issues/detail?id=1665
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1099 exploit report by Lokihardt (Jan 23, 2017)]
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4386
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2468 Mitre report]
* https://packetstormsecurity.com/files/155871/Sony-Playstation-4-Webkit-Code-Execution.html
* [https://www.exploit-db.com/exploits/41868 exploitDB report]
* https://twitter.com/Fire30_/status/1211775229116211200
* [https://github.com/0xR0/uxss-db/tree/master/webkit/CVE-2017-2468 Mirror of report and PoC]
* [https://bugs.chromium.org/p/chromium/issues/detail?id=541206 Similar bug (CVE-2015-6770) with similar PoC (Oct 8, 2015)]


==== Bug Description ====
==== Bug Description ====
WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary does not invalidate the ForInContext object.
It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated.
This is a Type Confusion exploit.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/Fire30/bad_hoist Initial implementation by Fire30]
* [https://github.com/Metnew/uxss-db/tree/master/webkit/CVE-2017-2468 PoC that just crashes on PS4 FW 4.05-5.56 and PS Vita FW 3.60]
* [https://github.com/sleirsgoevy/bad_hoist Implementation with code execution by sleirsgoevy]


==== Patched ====
==== Patched ====
'''Yes''' in 7.00 FW
'''Yes''' in 6.00 FW. Vulnerable at least on PS4 FWs 4.05-5.56 and PS Vita FW 3.60.
----
----


=== FW 4.50-6.72 - DOMWindow::open heap UaF (CVE-2021-30849) leading to crash ===
=== FW 4.50-5.56 - WebCore::HTMLFrameElementBase::marginHeight() Heap UaF (CVE-2016-1859) leading to arbitrary RW ===


==== Credits ====
==== Credits ====
* Sergei Glazunov (from Google Project Zer0) for the exploit PoC (Jul 1, 2021)
* Liang Chen, wushi of KeenLab, Tencent working with Trend Micro's Zero Day Initiative for discovering this vulnerability (2016-03-16)


==== Analysis ====
==== Analysis ====
* https://bugs.chromium.org/p/project-zero/issues/detail?id=2204
* [https://nvd.nist.gov/vuln/detail/CVE-2016-1859 NVD description of CVE-2016-1859 (May 5, 2016)]
* [https://www.zerodayinitiative.com/advisories/ZDI-16-352/ ZDI advisory for CVE-2016-1859 (May 20, 2016)]
* [https://www.blackhat.com/docs/us-16/materials/us-16-Molinyawe-Shell-On-Earth-From-Browser-To-System-Compromise-wp.pdf Writeup by Matt Molinyawe, Abdul-Aziz Hariri, and Jasiel Spelman (Trend Micro) (August 1, 2016)]
* [http://arayz.github.io/933ky/A-general-attack-model-of-UAF-on-browser/ Writeup by Arayz (Wang Ao) (March 31, 2017)]
* [https://daehee87.github.io/data/ruma.pdf On the Analysis of Byte-Granularity Heap Randomization (October 24, 2019)]


==== Bug Description ====
==== Bug Description ====
The specific flaw exists within the handling of GraphicsContext objects. By manipulating a document's elements an attacker can force this object in memory to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process.
CVE-2016-1859 is a use-after-free vulnerability that existed in the Safari web browser. A GraphicsContext object is used in the setPlatformTextDrawingMode function after it has been freed. The successful triggering of the use-after-free vulnerability itself does not allow the attacker to directly change the control flow or disclose arbitrary memory contents. However, the use-after-free yields an arbitrary-memory-write primitive by hijacking a destination pointer that will be used for the memcpy function. Once the arbitrary-memory-write primitive is achieved, the attacker sprays the heap with string objects to achieve the arbitrary-memory-read primitive. Relying on the pointer width heap alignment, the attacker can accurately predict the exact address of one of the string objects among the heap spray and pinpoint the address of member variable. At this point, the attacker can overwrite the length member variable of a string object and partially disclose the out-of-bound heap area exceeding the buffer address of the string. The partial disclosure of the heap memory allows the attacker to extend the information leak step-by-step and ultimately allows full chaining of ROP, which leads to arbitrary code execution.


==== Exploit Implementation ====
==== Exploit Implementation ====
* PoC publicly available
* No full exploit publicly available but exploitation description is detailed


==== Patched ====
==== Patched ====
'''Yes''' in 7.00 FW.
'''Yes''' in 6.00 FW. Vulnerable on PS4 FWs 4.50-5.56.
 
==== Tested ====
Vulnerable on PS4 FWs 4.50-6.72. Not vulnerable on FWs <= 4.07. Not vulnerable on FWs >=7.00 according to manual tests but need to check WebKit sources.
----
----


=== FW 4.50-6.20 - JSArray::shiftCountWithArrayStorage() OOB RW (CVE-2018-4441) leading to arbitrary RW ===
=== FW 4.50-5.01 - Element::setAttributeNodeNS() UaF leading to arbitrary RW ===


==== Credits ====
==== Credits ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Oct 3, 2018)
* Lokihardt (from Google Project Zer0) for the exploit PoC (Mar 15, 2017)
* Specter for the rewriting for PS4 (Mar 8, 2019)
* qwertyoruiop for the PS4 exploit (October 2017)
* St4rk for helping Specter
* Specter for the writeup (May 27, 2018)


==== Analysis ====
==== Analysis ====
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1685 Bug report by Lokihardt (Oct 3, 2018)]
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1187 exploit report by Lokihardt (Mar 15, 2017)]
* [https://github.com/WebKit/webkit/commit/51a62eb53815863a1bd2dd946d12f383e8695db0 WebKit fix commit (Oct 15, 2018)]
* [https://twitter.com/VVildCard777/status/919843554964443137 First test on PS4 by WildCard (Oct 16, 2017)]
* [https://mastodon.social/@buherator/101654714198519755 Announce of incoming write-up by rkmylo and buherator/stratan/@5tratan, Meligra Team (Feb 25, 2019)]
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/WebKit/setAttributeNodeNS%20UAF%20Write-up.md Specter's setAttributeNodeNS Exploit Writeup]
* [https://rstforums.com/forum/topic/110439-cve-2018-4441-oob-rw-via-jsarrayunshiftcountwitharraystorage-webkit/ Write-up mirrored by Nytro (Feb 27, 2019)]


==== Bug Description ====
==== Bug Description ====
We would take the fast path for JSArray::shiftCountWithArrayStorage when the array hasHoles(). However, the code for this was wrong. It would incorrectly update ArrayStorage::m_numValuesInVector.
By forcing setAttributeInternal() to call setAttributeNodeNS() twice, an attribute node reference will be added twice to the list. When one is free()'d, the second attribute still contains a duplicate stale reference, leading to a use-after-free (UAF) scenario.  


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/Cryptogenic/PS4-6.20-WebKit-Code-Execution-Exploit PS4 6.20 WebKit exploit by Specter]
[https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit PS4 5.05 WebKit + Kernel Exploit]


==== Patched ====
==== Patched ====
'''Yes''' in 6.50 FW.
'''Yes''' in 5.03 FW.
 
==== Tested ====
It does not work on <= 4.07 FW PS4 according to tests as the exploit fails at step "Triggering memory corruption".
----
----


=== FW 6.00-6.20 - JSC::arrayProtoPrivateFuncConcatMemcpy() Information Leak (CVE-2018-4358) ?leading to ASLR defeat? ===
=== FW 3.15-4.07 - Stack Uninitialized Read UaF leading to arbitrary RW ===


==== Credits ====
==== Credits ====
* bkth, niklasb and saelo (from phoenhex Team) for the exploit PoC in Safari (Sep 26, 2018)
* qwertyoruiop for the exploit
* Vultra for discovering that the exploit worked on PS4 FW 6.00 (Dec 10, 2018)
* Specter for the writeup


==== Analysis ====
==== Analysis ====
* Related: https://bugs.chromium.org/p/project-zero/issues/detail?id=1032
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/4.0x%20WebKit%20Exploit%20Writeup.md Specter's 4.0x WebKit Exploit Writeup]
* Related: https://doar-e.github.io/blog/2018/07/14/cve-2017-2446-or-jscjsglobalobjectishavingabadtime/
* https://github.com/WebKit/webkit/commit/b68b373dcbfbc68682ceeca8292c5c0051472071
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4358
* https://phoenhex.re/2018-09-26/safari-array-concat


==== Bug Description ====
==== Bug Description ====
Via a specially crafted valueOf() function of an arguments.length() function, non-zero indexes of the stack-allocated array are not initialized, leading to a stack uninitialized read. This can be abused to store a reference that can later be re-obtained post-GC (garbage collection) yielding a use-after-free() (UAF) situation.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/externalist/exploit_playground/blob/master/jsc_ConcatMemcpy_infoleak/ileak.html PoC for iOS]
* [https://github.com/Cryptogenic/PS4-4.0x-Code-Execution-PoC Specter's commented and usable version]
* [https://github.com/Josephmh97/PS4_jsc_ConcatMemcpy_POC PoC for PS4]
* [https://gist.github.com/X41/36acd2a6939e4cebbecba45d35bf0d75 mirrorred expl.js from qwertyoruiop]


==== Patched ====
==== Patched ====
'''Yes''' in 6.50 FW
'''Yes''' in 4.50 FW


==== Tested ====
==== Tested ====
Works on 6.00-6.20. Not working on PS4 FWs <= 5.56 because JSC (JavaScriptCore) was too old.
Works on 3.15-4.07. Not working on <= 3.11.
----
----


=== FW 4.50-5.56 - JSGlobalObject::haveABadTime() Type Confusion (CVE-2017-7005) leading to arbitrary RW ===
=== FW 3.15-3.70 - JSArray::sortCompactedVector() Heap UaF leading to arbitrary RW ===


==== Credits ====
==== Credits ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Mar 20, 2017)
* xyz for the original exploit on PSVita (HENkaku)
* ALEXZZZ9 for the first PS4 implementation (on 5.01), and at same time for burning the exploit (Feb 20, 2018)
* Fire30 for porting to PS4
* qwertyoruiop for rewriting and porting to 5.05 and 5.50
* Specter for improved PS4 playground


==== Analysis ====
==== Analysis ====
[https://bugs.chromium.org/p/project-zero/issues/detail?id=1208 Project Zer0 Bug Description]
* [https://blog.xyz.is/2016/webkit-360.html PSVita 3.60 HENKaku WebKit exploit writeup]


==== Bug Description ====
==== Bug Description ====
When JSGlobalObject::haveABadTime() is called with arrays of a different JSGlobalObject type, type confusion can occur, leading to memory corruption.
When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer is not re-updated nor nulled. When this memory in free()'d, the reference is maintained and thus memory corruption can occur.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/ALEXZZZ9/PS4-5.01-WebKit-Exploit-PoC]
* [https://github.com/henkaku/henkaku/blob/master/webkit/exploit.js PSVita 3.60 WebKit exploit by xyz]
* [http://crack.bargains/550/ PS4 5.50 (WebKit Only)]
* [https://github.com/Fire30/PS4-3.55-Code-Execution-PoC PS4 playground 3.15-3.70 by Fire30]
* [https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/master/expl.js]
* [https://github.com/Cryptogenic/PS4-Playground-3.55 Improved PS4 playground 3.15-3.70 by Specter]


==== Patched ====
==== Patched ====
'''Yes''' in 6.00 FW
'''Yes''' in 4.0?0? FW
 
==== Tested ====
Works on 3.15-3.70. Not working on <= 3.11. Maybe working on 4.00.
----
----


=== FW ?.??-4.05-5.56 - Document::adoptNode() UaF (CVE-2017-2468) leading to crash ===
=== FW <= 3.50 - WebCore::TimerBase::heapPopMin() Heap UaF leading to crash ===


==== Credits ====
==== Analysis ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Jan 23, 2017)
* [https://github.com/WebKit/WebKit-http/commit/98845d940e30529098eea7e496af02e14301c704 WebKit fix commit (17-05-2016)]
* CelesteBlue for testing on PS4 and PS Vita (May 9, 2020)
* [https://xz.aliyun.com/t/292 Summary of Critical and Exploitable iOS Vulnerabilities in 2016 by Min (Spark) Zheng, Cererdlong, Eakerqiu @ Team OverSky]
 
==== Analysis ====
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1099 exploit report by Lokihardt (Jan 23, 2017)]
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2468 Mitre report]
* [https://www.exploit-db.com/exploits/41868 exploitDB report]
* [https://github.com/0xR0/uxss-db/tree/master/webkit/CVE-2017-2468 Mirror of report and PoC]
* [https://bugs.chromium.org/p/chromium/issues/detail?id=541206 Similar bug (CVE-2015-6770) with similar PoC (Oct 8, 2015)]


==== Bug Description ====
==== Bug Description ====
"As of firmware version 3.55 a patch has been included to prevent a use-after-free segmentation fault from being exploited. This could have led to a ROP chain and code execution. It would have been cool if someone would have done some real research on it..." qwertyoruiop


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/Metnew/uxss-db/tree/master/webkit/CVE-2017-2468 PoC that just crashes on PS4 FW 4.05-5.56 and PS Vita FW 3.60]
* [http://psxhax.com/threads/ps4-3-50-webkit-exploit-from-playstation-4-dev-qwertyoruiop.450/ Article about qwertyoruiop's tests (20-05-2016)]
* [http://psxhax.com/threads/ps4-heap-use-after-free-at-webcore-3-50-poc-by-hunter128.452/ Article about initial PoC for PS4 (21-05-2016)]
* [http://wololo.net/talk/viewtopic.php?t=45888 Initial PoC for PS4 (21-05-2016)]
* [https://web.archive.org/web/20161030085033/http://cryptoanarchic.me/wat.txt iOS 9.3.2 WebKit RCE via heapPopMin (07-2016)]
* [https://twitter.com/qwertyoruiopz/status/756268361282125824 qwertyoruiop's tweet (22-07-2016)]
* [https://github.com/Jailbreaks/jbme/tree/master mirror of iOS 9.3.2 WebKit RCE via heapPopMin]


==== Patched ====
==== Patched ====
'''Yes''' in 6.00 FW. Vulnerable at least on PS4 FWs 4.05-5.56 and PS Vita FW 3.60.
'''Yes''' in 3.55 FW
 
==== Tested ====
Works on 3.15, 3.50 FW. Maybe working on 3.51 FW.
----
----


=== FW 4.50-5.56 - WebCore::HTMLFrameElementBase::marginHeight() Heap UaF (CVE-2016-1859) leading to arbitrary RW ===
=== FW <= ?2.50? - JavaScript OnLoad Handler Remote Code Execution Vulnerability (CVE-2005-1790) leading to crash or lag ===


==== Credits ====
==== Credits ====
* Liang Chen, wushi of KeenLab, Tencent working with Trend Micro's Zero Day Initiative for discovering this vulnerability (2016-03-16)
* Benjamin Tobias Franz for the vulnerability discovery (2005-11-21)
* Stuart Pearson for the Proof of Concept on Microsoft Internet Explorer
* Sam Sharps for the Metasploit port (2012-01)
* Jeerum for disclosing that the vulnerability affects PS4 <=2.50 (2014-10-31).


==== Analysis ====
==== Analysis ====
* [https://nvd.nist.gov/vuln/detail/CVE-2016-1859 NVD description of CVE-2016-1859 (May 5, 2016)]
* [https://web.archive.org/web/20150617052519/http://sebug.net:80/paper/Exploits-Archives/2012-exploits/1201-exploits/ms05_054_onload.rb.txt Metasploit file by Sam Sharps (2012-01)]
* [https://www.zerodayinitiative.com/advisories/ZDI-16-352/ ZDI advisory for CVE-2016-1859 (May 20, 2016)]
* [https://malware.wicar.org/data/ms05_054_onload.html PoC by wicar.org (before 2012-11-10)]
* [https://www.blackhat.com/docs/us-16/materials/us-16-Molinyawe-Shell-On-Earth-From-Browser-To-System-Compromise-wp.pdf Writeup by Matt Molinyawe, Abdul-Aziz Hariri, and Jasiel Spelman (Trend Micro) (August 1, 2016)]
* [https://wololo.net/talk/viewtopic.php?f=63&t=40446 PoC for PS4 by Jeerum (2014-10-31)]
* [http://arayz.github.io/933ky/A-general-attack-model-of-UAF-on-browser/ Writeup by Arayz (Wang Ao) (March 31, 2017)]
* [https://www.youtube.com/watch?v=J_-1nyfCo84 PS4 4.55 test of 1js by Jeerum]
* [https://daehee87.github.io/data/ruma.pdf On the Analysis of Byte-Granularity Heap Randomization (October 24, 2019)]


==== Bug Description ====
==== Bug Description ====
The specific flaw exists within the handling of GraphicsContext objects. By manipulating a document's elements an attacker can force this object in memory to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process.
This bug is triggered when the browser handles a JavaScript 'onLoad' handler in conjunction with an improperly initialized 'window()' JavaScript function. This exploit results in a call to an address lower than the heap. The javascript prompt() places our shellcode near where the call operand points to. We call prompt() multiple times in separate iframes to place our return address. We hide the prompts in a popup window behind the main window. We spray the heap a second time with our shellcode and point the return address to the heap. I use a fairly high address to make this exploit more reliable. Microsoft Internet Explorer will crash when the exploit completes. Also, please note that Microsoft Internet Explorer must allow popups in order to continue exploitation.
 
CVE-2016-1859 is a use-after-free vulnerability that existed in the Safari web browser. A GraphicsContext object is used in the setPlatformTextDrawingMode function after it has been freed. The successful triggering of the use-after-free vulnerability itself does not allow the attacker to directly change the control flow or disclose arbitrary memory contents. However, the use-after-free yields an arbitrary-memory-write primitive by hijacking a destination pointer that will be used for the memcpy function. Once the arbitrary-memory-write primitive is achieved, the attacker sprays the heap with string objects to achieve the arbitrary-memory-read primitive. Relying on the pointer width heap alignment, the attacker can accurately predict the exact address of one of the string objects among the heap spray and pinpoint the address of member variable. At this point, the attacker can overwrite the length member variable of a string object and partially disclose the out-of-bound heap area exceeding the buffer address of the string. The partial disclosure of the heap memory allows the attacker to extend the information leak step-by-step and ultimately allows full chaining of ROP, which leads to arbitrary code execution.


==== Exploit Implementation ====
==== Exploit Implementation ====
* PoC publicly available
* No full exploit publicly available but exploitation description is detailed


==== Patched ====
==== Patched ====
'''Yes''' in 6.00 FW. Vulnerable on PS4 FWs 4.50-5.56.
'''Maybe'''
 
==== Tested ====
* Working on 1.76-2.50 FW: crash. 3.00-5.50 error CE-36329-3. 4.55 lag in background TV application (for example Netflix application).
----
----


=== FW 4.50-5.01 - Element::setAttributeNodeNS() UaF leading to arbitrary RW ===
=== FW <= 2.03 - WebCore::CSSSelector Heap Overflow (CVE-2014-1303) leading to arbitrary RW ===


==== Credits ====
==== Credits ====
* Lokihardt (from Google Project Zer0) for the exploit PoC (Mar 15, 2017)
* KeenTeam for finding and documenting the bug
* qwertyoruiop for the PS4 exploit (October 2017)
* Liang Chen from KeenTeam for the writeups
* Specter for the writeup (May 27, 2018)
* xyz for porting to PSVita FWs 3.30-3.36
* Fire30 for porting to PS4
* dreadlyei (unknown person, credited by Fire30)


==== Analysis ====
==== Analysis ====
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1187 exploit report by Lokihardt (Mar 15, 2017)]
* [https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not.PDF BlackHat EU 2014 'WebKit Everywhere - Secure Or Not?' slides]
* [https://twitter.com/VVildCard777/status/919843554964443137 First test on PS4 by WildCard (Oct 16, 2017)]
* [https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not-WP.pdf BlackHat EU 2014 'WebKit Everywhere - Secure Or Not?' PDF]
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/WebKit/setAttributeNodeNS%20UAF%20Write-up.md Specter's setAttributeNodeNS Exploit Writeup]
* [https://cansecwest.com/slides/2015/Liang_CanSecWest2015.pdf Attacking WebKit Applications by exploiting memory corruption bugs by Liang Chen]


==== Bug Description ====
==== Bug Description ====
By forcing setAttributeInternal() to call setAttributeNodeNS() twice, an attribute node reference will be added twice to the list. When one is free()'d, the second attribute still contains a duplicate stale reference, leading to a use-after-free (UAF) scenario.  
By forcing addRule() to be called on a CSS Selector via window.getMatchedCSSRules(), a 1-bit OOB write can be achieved and leveraged to corrupt heap memory.


==== Exploit Implementation ====
==== Exploit Implementation ====
[https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit PS4 5.05 WebKit + Kernel Exploit]
* [https://github.com/Fire30/PS4-2014-1303-POC ROP PoC for PS4 FW 2.03 by Fire30]
* [http://wololo.net/2016/04/21/proof-of-concept-webkit-exploit-running-on-ps4-firmwares-up wololo article]
* WebKit exploit for 3.30-3.36 FW PSVita by xyz: used in vitasploit
* [https://github.com/RKX1209/CVE-2014-1303 PoC for Linux by RKX1209]


==== Patched ====
==== Patched ====
'''Yes''' in 5.03 FW.
'''Yes''' in 2.50 FW
 
==== Tested ====
* Working on 2.00-2.03 FW. Might work on 2.04 (99% sure as 2.04 PUP is about same size as 2.03 PUP).
* Working on AppleWebKit/537.73
* Maybe not working on FW < 2.00.
----
----


=== FW 3.15-4.07 - Stack Uninitialized Read UaF leading to arbitrary RW ===
=== FW <= 2.03-? - WebCore::ImageInputType::attach Heap UaF (CVE-2013-2857) leading to ROP execution ===


==== Credits ====
==== Credits ====
* qwertyoruiop for the exploit
* Chromium bugs reporters
* Specter for the writeup
* JumpCallPop, jam1garner, hedgeberg for inital exploit on Wii U
* yellows8 for ROP on Wii U
* orboditilt for increasing stability on Wii U
* zoogie for porting Wii U exploit to New3DS
* CelesteBlue for testing on PS4 FW 2.03


==== Analysis ====
==== Analysis ====
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/4.0x%20WebKit%20Exploit%20Writeup.md Specter's 4.0x WebKit Exploit Writeup]
* [https://bugs.chromium.org/p/chromium/issues/detail?id=240124 Chromium bug report with a PoC]


==== Bug Description ====
==== Bug Description ====
Via a specially crafted valueOf() function of an arguments.length() function, non-zero indexes of the stack-allocated array are not initialized, leading to a stack uninitialized read. This can be abused to store a reference that can later be re-obtained post-GC (garbage collection) yielding a use-after-free() (UAF) situation.
Use-after-free with input type image. Error event was fired synchronously blowing away the input element from underneath.
 
Exploiting this vulnerability on PS4 is not good because:
* This vulnerability does not provide arbitrary RW without code execution, hence ROP chain (at least to stack pivot to JiT code) must be made with a memory dump or decrypted modules for this FW gotten using another vulnerability.
* There is usermode ASLR since about FW 1.70 so ROP chain gadgets must be relocated at runtime. This means another vulnerability allowing usermode arbitrary read is needed.
* As usually an arbitrary read vulnerability also gives arbitrary write, and as arbitrary RW leads to usermode code execution (by hijacking JS pointers in virtual table), this UaF is not needed at all.
* Even if we get ROP chain to work on PS4 with this UaF vulnerability, there is no evidence that a return to JavaScript from ROP chain is doable, making this exploit less convenient than arbitrary RW exploits method of getting code execution then returning to usermode by restoring vtable.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/Cryptogenic/PS4-4.0x-Code-Execution-PoC Specter's commented and usable version]
* [https://github.com/WiiUTest/JsTypeHax Initial Wii U implementation]
* [https://gist.github.com/X41/36acd2a6939e4cebbecba45d35bf0d75 mirrorred expl.js from qwertyoruiop]
* [https://github.com/WiiUTest/JsTypeHax/blob/master/payload/exploit_WORKING.html Wii U stabler implementation (last update May 22, 2018)]
* [https://github.com/wiiu-env/JsTypeHax Wii U tabler implementation (last update Jan 13, 2019)]
* [https://github.com/Hiperhazz/wiiuexploit/blob/master/firmware/Exploit.html Wii U stabler implementation by Hiperhazz (last update May 26, 2020)]
* [https://github.com/zoogie/new-browserhax/blob/master/index.html New3DS implementation by zoogie (last update Aug 9, 2020)]


==== Patched ====
==== Patched ====
'''Yes''' in 4.50 FW
'''Yes''' in ? FW


==== Tested ====
==== Tested ====
Works on 3.15-4.07. Not working on <= 3.11.
* Working on 2.03 FW. Might work on 2.04 (99% sure as 2.04 PUP is about same size as 2.03 PUP).
----
----


=== FW <= ?4.05? - Type confusion in WebCore::HTMLInputElement::onSearch (CVE-2017-2354) ===
=== FW <= 1.76 - JSArray::sort() Heap Overflow (CVE-2012-3748, PSA 2013-0903-1) leading to arbitrary RW ===


==== Credits ====
==== Credits ====
* Neymar of Tencent's Xuanwu Lab working with Trend Micro's Zero Day Initiative for discovering this vulnerability (2016-11)
 
* Brent Fulgham for fixing the bug in WebKit (2016-11-14)
* Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013)
* Jasiel Spelman (@WanderingGlitch) for his writeup (2017-12-20)
* nas and Proxima for the first PS4 POC on 1.76 PS4 (Oct. 23, 2014)
* sony for patching the exploit in FW 2.00 (Oct 27, 2014)
* CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849]


==== Analysis ====
==== Analysis ====
* [https://www.zerodayinitiative.com/blog/2017/12/20/invariantly-exploitable-input-an-apple-safari-bug-worth-revisiting Writeup by Jasiel Spelman (2017-12-20)]
* [https://packetstormsecurity.com/files/cve/CVE-2012-3748 CVE-2012-3748]
* [https://github.com/WebKit/WebKit-http/commit/cf2bf6e58f51267d7ae25fcb82a315377c8e5cf6 WebKit fix commit by Brent Fulgham (2016-11-14)]
* [https://packetstormsecurity.com/files/123088/ PSA 2013-0903-1]
* [https://www.exploit-db.com/exploits/28081/ Exploit PoC by Vitaliy Toropov]


==== Bug Description ====
==== Bug Description ====
It is possible for JavaScript to change the type property of an input field. WebKit needs to gracefully handle this case.
By forcing the compare function to reduce the size of the array, trailing items will be written out of bounds (OOB write), leading to heap memory corruption.
 
This bug could have been prevented had it a debug check been used instead of a runtime check. In fact, WebKit has support for this type of assertion already through a RELEASE_ASSERT macro, which would have turned this exploitable bug into a simple denial-of-service by immediately and safely crashing the browser.
 
The fix commit of the vulnerability adds a type traits specialization so that WebKit can properly downcast InputType elements. This should be used only to call search functions on actual search input types.
 
Although the access violation in WebCore::TimerBase::heapPop is where we see the result of the bug, it is not the cause of the issue. The crash actually occurs as a result of reading a pointer that comes from the 'this' object. Based on that, it would seem that something is wrong with the Timer object passed into the WebCore::TimerBase::heapPop function.
 
This vulnerability may be the one used by Chaintin Tech with a kernel exploit on PS4 FW 4.01 at GeekPwn 2016, a Tencent Security's conference, in Shanghai Station at the Pavilion Safety Research Lab, (https://www.chaitin.cn/ps4, https://www.psxhax.com/threads/ps4-4-01-linux-installation-ksploit-demo-at-geekpwn-2016.932/)


==== Exploit Implementation ====
==== Exploit Implementation ====
* PoC by Neymar (2016-11, disclosed publicly by Jasiel Spelman on 2017-12-20):
* [http://wololo.net/talk/viewtopic.php?p=368577 first POC for 1.76 PS4 by nas and Proxima]
<source lang="js">
* [http://wololo.net/downloads/index.php/download/8230 mirror]
<input id="m_input" type="search"></input>
* [http://daxhordes.org/ps4_176/ps4_dump.html live test]
<script type="text/javascript">
* [http://daxhordes.org/ps4_176/ps4_dump2.html livetest2]
first = true;
* [http://daxhordes.org/ps4_176/ps4_rop2.html ROP2]
m_input.addEventListener("input", function (e) {
* [https://cturt.github.io/PS4-playground/ PS4 playground 1.76 by CTurt]
if(first) {
* [https://bitbucket.org/DaveeFTW/psvita-260-webkit/src/master/ PSVita 2.00-3.20 WebKit exploit]
first = false;
}
else {
m_input["type"] = "image";
}
}, false);
</script>
</source>
* [https://github.com/WebKit/WebKit-http/blob/master/LayoutTests/fast/forms/search-cancel-button-change-input.html Vulnerability test by Brent Fulgham (2016-11-15)]


==== Patched ====
==== Patched ====
'''Maybe''' in 4.06 FW
'''Yes''' in 2.00 FW


==== Tested ====
==== Tested ====
Not yet.
* Working on 1.00-1.76 FW, AppleWebKit/531.3-536.26
----
* Might work on FW 0.930.020.
 
== Usermode securities ==


=== FW 3.15-3.70 - JSArray::sortCompactedVector() Heap UaF leading to arbitrary RW ===
=== Usermode ASLR ===


==== Credits ====
* Very old firmwares (<= 1.05) do not have ASLR enabled, but it was introduced sometime before firmware 1.70. "Address Space Layout Randomization" (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4.
* xyz for the original exploit on PSVita (HENkaku)
* To defeat usermode ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address.
* Fire30 for porting to PS4
* Specter for improved PS4 playground


==== Analysis ====
=== Module imports table cleaned before execution ===
* [https://blog.xyz.is/2016/webkit-360.html PSVita 3.60 HENkaku WebKit exploit writeup]


==== Bug Description ====
* Between 1.76 and 4.05, Sony did that to prevent WebKit exploiters from defeating usermode ASLR easily.
When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer is not re-updated nor nulled. When this memory in free()'d, the reference is maintained and thus memory corruption can occur.
* Now we have to dump entire usermode sandboxed memory, and by studying it we can defeat ASLR:
1. Chose a function (ex: __stack_chk_fail) imported from libkernel.sprx by libSceWebkit2.sprx


==== Exploit Implementation ====
2. Read pointer contained at the address where the call is done
* [https://github.com/henkaku/henkaku/blob/master/webkit/exploit.js PSVita 3.60 WebKit exploit by xyz]
* [https://github.com/Fire30/PS4-3.55-Code-Execution-PoC PS4 playground 3.15-3.70 by Fire30]
* [https://github.com/Cryptogenic/PS4-Playground-3.55 Improved PS4 playground 3.15-3.70 by Specter]


==== Patched ====
3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module
'''Yes''' in 4.0?0? FW


==== Tested ====
4. This result is LibKernel base address. This method works for any imported module.
Works on 3.15-3.70. Not working on <= 3.11. Maybe working on 4.00.
----


=== FW <= 3.50 - WebCore::TimerBase::heapPopMin() Heap UaF leading to crash ===
For FW >= 6.00, for web applications, libkernel.sprx has been replaced by libkernel_web.sprx and libSceWebKit2 by libSceNKWebKit.sprx. libkernel.sprx is still used by other applications.


==== Credits ====
=== DEP / NX ===
* Brent Fulgham for fixing the bug in WebKit (2016-05-16)


==== Analysis ====
* "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to usermode memory then executing it.
* [https://github.com/WebKit/WebKit-http/commit/98845d940e30529098eea7e496af02e14301c704 WebKit fix commit (2016-05-17)]
* 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs).
* [https://xz.aliyun.com/t/292 Summary of Critical and Exploitable iOS Vulnerabilities in 2016 by Min (Spark) Zheng, Cererdlong, Eakerqiu @ Team OverSky]


==== Bug Description ====
=== JiT removed from webbrowser ===
"As of firmware version 3.55 a patch has been included to prevent a use-after-free segmentation fault from being exploited. This could have led to a ROP chain and code execution. It would have been cool if someone would have done some real research on it..." qwertyoruiop


==== Exploit Implementation ====
* On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched.
* [http://psxhax.com/threads/ps4-3-50-webkit-exploit-from-playstation-4-dev-qwertyoruiop.450/ Article about qwertyoruiop's tests (2016-05-20)]
* Checking the source code at [https://doc.dl.playstation.net/doc/ps4-oss/webkit.html ps4-oss], starting as early as FW 6.00, ENABLE_JIT=OFF for -DPORT=PlayStation4. It means that JIT functionality is completely removed from WebKit and there is no JIT coprocess that is allowed to request RWX memory to even attack. Even if there are JIT bugs that can lead us to request RWX memory in other platforms, we can't on the PS4 as there is no longer any JIT process. Unchecked all source codes, JIT process could have been removed earlier than 6.00. All exploits must use ROP.
* [http://psxhax.com/threads/ps4-heap-use-after-free-at-webcore-3-50-poc-by-hunter128.452/ Article about initial PoC for PS4 (2016-05-21)]
* Workaround is to use ROP.
* [http://wololo.net/talk/viewtopic.php?t=45888 Initial PoC for PS4 (2016-05-21)]
* [https://web.archive.org/web/20161030085033/http://cryptoanarchic.me/wat.txt iOS 9.3.2 WebKit RCE via heapPopMin (2016-07)]
* [https://twitter.com/qwertyoruiopz/status/756268361282125824 qwertyoruiop's tweet (2016-07-22)]
* [https://github.com/Jailbreaks/jbme/tree/master mirror of iOS 9.3.2 WebKit RCE via heapPopMin]


==== Patched ====
=== Syscalls removed ===
'''Yes''' in 3.55 FW


==== Tested ====
* See the PS4 [[Syscalls]] list.
Works on 3.15, 3.50 FW. Maybe working on 3.51 FW.
----


=== FW <= ?2.50? - JavaScript OnLoad Handler Remote Code Execution Vulnerability (CVE-2005-1790) leading to crash or lag ===
=== Syscall 0 disabled i.e Error Kernel: The application directly issues a syscall instruction (24) ===


==== Credits ====
* Between 2.00 and 2.57, SCE has removed system call 0, so we can no longer call any syscall we want by specifying the call number in the rax register.
* Benjamin Tobias Franz for the vulnerability discovery (2005-11-21)
* Doing so now crashes the app and gives error CE-34878-0, SCE_KERNEL_ABORT_REASON_SYSTEM_ILLEGAL_FUNCTION_CALL, with the message "Kernel: The application directly issues a syscall instruction (24)".
* Stuart Pearson for the Proof of Concept on Microsoft Internet Explorer
* We now have to use wrappers provided to us from the libkernel / libkernel_web / libkernel_sys modules to access system calls.
* Sam Sharps for the Metasploit port (2012-01)
 
* Jeerum for disclosing that the vulnerability affects PS4 <=2.50 (2014-10-31).
=== bpf_write function stripped out of the kernel ===


==== Analysis ====
* On 4.70, bpfwrite() was stripped out of the kernel entirely to patch kernel vulnerability exploited in 4.55 kexploit.
* [https://web.archive.org/web/20150617052519/http://sebug.net:80/paper/Exploits-Archives/2012-exploits/1201-exploits/ms05_054_onload.rb.txt Metasploit file by Sam Sharps (2012-01)]
* [https://malware.wicar.org/data/ms05_054_onload.html PoC by wicar.org (before 2012-11-10)]
* [https://wololo.net/talk/viewtopic.php?f=63&t=40446 PoC for PS4 by Jeerum (2014-10-31)]
* [https://www.youtube.com/watch?v=J_-1nyfCo84 PS4 4.55 test of 1js by Jeerum]


==== Bug Description ====
=== bpf_open function blocked for unprivileged processes ===
This bug is triggered when the browser handles a JavaScript 'onLoad' handler in conjunction with an improperly initialized 'window()' JavaScript function. This exploit results in a call to an address lower than the heap. The javascript prompt() places our shellcode near where the call operand points to. We call prompt() multiple times in separate iframes to place our return address. We hide the prompts in a popup window behind the main window. We spray the heap a second time with our shellcode and point the return address to the heap. I use a fairly high address to make this exploit more reliable. Microsoft Internet Explorer will crash when the exploit completes. Also, please note that Microsoft Internet Explorer must allow popups in order to continue exploitation.


==== Exploit Implementation ====
* On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF.


==== Patched ====
=== bpf_ioctl function blocked or removed ===
'''Maybe'''


==== Tested ====
* On FW 5.50+, opening BPF is still possible in less sandboxed apps like TestKit/DevKits fSELFs. But this is useless because ioctl does not work.
* Working on 1.76-2.50 FW: crash. 3.00-5.50 error CE-36329-3. 4.55 lag in background TV application (for example Netflix application).
----


=== FW <= 2.03 - WebCore::CSSSelector Heap Overflow (CVE-2014-1303) leading to arbitrary RW ===
=== Device access blocked/removed from webbrowser ===


==== Credits ====
* Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from the web browser.
* KeenTeam for finding and documenting the bug
 
* Liang Chen from KeenTeam for the writeups
=== Pointer poisoning in WebKit on 6.xx firmwares ===
* xyz for porting to PSVita FWs 3.30-3.36
 
* Fire30 for porting to PS4
* For select types implemented by WebKit (such as JSC::JSFunction), certain pointer fields are XOR'ed by a cryptographic key generated at runtime. The key is generated once every process launch, one must recover it to unpoison the pointers.
* dreadlyei (unknown person, credited by Fire30)
 
== Kernel Exploits ==
 
=== FW <= 11.52 - Double free in bnet_netevent_set_queue ===
 
==== Credits ====
* Anonymous for sharing 11.52 and 12.00 PS4 kernel dumps.
* 2024-09-27 D-Link Turtle for diffing 11.52 and 12.00 PS4 kernel dumps.
* 2024-10-04 SlidyBat for figuring out the bug in bnet and its impact.


==== Analysis ====
==== Analysis ====
* [https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not.PDF BlackHat EU 2014 'WebKit Everywhere - Secure Or Not?' slides]
* [https://x.com/iMrDJAi/status/1842306232125964473/photo/1 Analysis by abc (2024-10-04)]
* [https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not-WP.pdf BlackHat EU 2014 'WebKit Everywhere - Secure Or Not?' PDF]
* [https://cansecwest.com/slides/2015/Liang_CanSecWest2015.pdf Attacking WebKit Applications by exploiting memory corruption bugs by Liang Chen]


==== Bug Description ====
==== Bug Description ====
By forcing addRule() to be called on a CSS Selector via window.getMatchedCSSRules(), a 1-bit OOB write can be achieved and leveraged to corrupt heap memory.
A double free can happen by racing calls to bnet_netevent_set_queue and bnet_netevent_unset_queue.
 
The lack of mutexes allowed double free as fdrop is called unconditionally in bnet_netevent_unset_queue.
 
See also PS Vita SceNetPs kernel module that uses similar bnet functions.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/Fire30/PS4-2014-1303-POC ROP PoC for PS4 FW 2.03 by Fire30]
* [http://wololo.net/2016/04/21/proof-of-concept-webkit-exploit-running-on-ps4-firmwares-up wololo article]
* WebKit exploit for 3.30-3.36 FW PSVita by xyz: used in vitasploit
* [https://github.com/RKX1209/CVE-2014-1303 PoC for Linux by RKX1209]


==== Patched ====
==== Patched ====
'''Yes''' in 2.50 FW
'''Yes''' in 12.00 FW. Maybe not working at all on PS5.


==== Tested ====
The bug was patched in PS4 FW 12.00 by adding some mutexes in bnet_netevent functions
* Working on 2.00-2.03 FW. Might work on 2.04 (99% sure as 2.04 PUP is about same size as 2.03 PUP).
* Working on AppleWebKit/537.73
* Maybe not working on FW < 2.00.
----
----


=== FW <= 2.03-? - WebCore::ImageInputType::attach Heap UaF (CVE-2013-2857) leading to ROP execution ===
=== FW <= 11.00 - Remote vulnerabilities in spp (yielding kernel ASLR defeat) (CVE-2006-4304 and no-CVE) ===


==== Credits ====
==== Credits ====
* Chromium bugs reporters
* 2006-08-23 Martin Husemann, Pavel Cahyna for discovering the first spp bug (CVE-2006-4304) on FreeBSD 4.11-6.1.
* JumpCallPop, jam1garner, hedgeberg for inital exploit on Wii U
* 2023-09-22 TheFloW for discovering that PS4 and PS5 are vulnerable to CVE-2006-4304, discovering second spp bug, and chaining them together.
* yellows8 for ROP on Wii U
* 2024-01-27 anonymous for reporting publicly CVE-2006-4304 as working on PS4 and PS5. See [https://i0.wp.com/wololo.net/wagic/wp-content/uploads/2024/02/initial_claims.png?w=603&ssl=1] and [https://ibb.co/sVb39Zj].
* orboditilt for increasing stability on Wii U
* 2024-03 iMrDJAi for porting CVE-2006-4304 to PS4 and PS5.
* zoogie for porting Wii U exploit to New3DS
* 2024-04-25 TheFloW for disclosing his HackerOne report including the second spp bug description.
* CelesteBlue for testing on PS4 FW 2.03
* 2024-04-30 TheFloW for releasing his exploit code for PS4 9.00 and 11.00.


==== Analysis ====
==== Analysis ====
* [https://bugs.chromium.org/p/chromium/issues/detail?id=240124 Chromium bug report with a PoC]
* [https://www.freebsd.org/security/advisories/FreeBSD-SA-06:18.ppp.asc FreeBSD Security Advisory for CVE-2006-4304 (2006-08-23)]
* [https://hackerone.com/reports/2177925 HackerOne report about Remote vulnerabilities in spp by TheFloW (2023-09-22)]


==== Bug Description ====
==== Bug Description ====
Use-after-free with input type image. Error event was fired synchronously blowing away the input element from underneath.
A malicious PPPoE server can cause denial-of-service or remote code execution in kernel context on the PS4/PS5. It does not require any usermode code execution to be triggered. There are two vulnerabilities that can be chained together to cause remote kernel Denial of Service, kernel ASLR defeat or kernel code execution : Heap buffer overwrite and overread in sppp_lcp_RCR and sppp_ipcp_RCR (CVE-2006-4304) and Integer underflow in sppp_pap_input leading to heap-buffer overread (no-CVE).


Exploiting this vulnerability on PS4 is not good because:
The PS4/PS5 must be connected using an ethernet cable to a device able to trigger PPPoE requests and analyze the responses.
* This vulnerability does not provide arbitrary RW without code execution, hence ROP chain (at least to stack pivot to JiT code) must be made with a memory dump or decrypted modules for this FW gotten using another vulnerability.
* There is usermode ASLR since about FW 1.70 so ROP chain gadgets must be relocated at runtime. This means another vulnerability allowing usermode arbitrary read is needed.
* As usually an arbitrary read vulnerability also gives arbitrary write, and as arbitrary RW leads to usermode code execution (by hijacking JS pointers in virtual table), this UaF is not needed at all.
* Even if we get ROP chain to work on PS4 with this UaF vulnerability, there is no evidence that a return to JavaScript from ROP chain is doable, making this exploit less convenient than arbitrary RW exploits method of getting code execution then returning to usermode by restoring vtable.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/WiiUTest/JsTypeHax Initial Wii U implementation]
* [https://github.com/iMrDJAi/FreeBSD9-CVE-2006-4304 CVE-2006-4304 PoC for FreeBSD9 by iMrDJAi (2024-04-07)]
* [https://github.com/WiiUTest/JsTypeHax/blob/master/payload/exploit_WORKING.html Wii U stabler implementation (last update May 22, 2018)]
* [https://gist.github.com/iMrDJAi/847a4f2eeff9669657ffcdf85ac7a901 CVE-2006-4304 PoC for PS4 and PS5 by iMrDJAi (2024-04-07)]
* [https://github.com/wiiu-env/JsTypeHax Wii U tabler implementation (last update Jan 13, 2019)]
* [https://github.com/TheOfficialFloW/PPPwn spp exploit for PS4 9.00 and 11.00 by TheFloW (2024-04-30)]
* [https://github.com/Hiperhazz/wiiuexploit/blob/master/firmware/Exploit.html Wii U stabler implementation by Hiperhazz (last update May 26, 2020)]
* [https://github.com/zoogie/new-browserhax/blob/master/index.html New3DS implementation by zoogie (last update Aug 9, 2020)]


==== Patched ====
==== Patched ====
'''Yes''' in ? FW
'''Yes''' in 11.02 FW
 
==== Tested ====
* Working on 2.03 FW. Might work on 2.04 (99% sure as 2.04 PUP is about same size as 2.03 PUP).
----
----


=== FW <= 1.76 - JSArray::sort() Heap Overflow (CVE-2012-3748, PSA 2013-0903-1) leading to arbitrary RW ===
=== FW <= 9.00 - PPPoE driver remote buffer overflow (CVE-2022-29867) ===


==== Credits ====
==== Credits ====
 
* 2021-09-24 m00nbsd for finding the vulnerability
* Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013)
* 2022-05-04 martin of NetBSD for fixing the vulnerability publicly in NetBSD 8 and 9
* nas and Proxima for the first PS4 POC on 1.76 PS4 (October 23, 2014)
* 2022-05-11 m00nbsd for disclosing the vulnerability publicly on HackerOne
* sony for patching the exploit in FW 2.00 (October 27, 2014)
* CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849]


==== Analysis ====
==== Analysis ====
* [https://packetstormsecurity.com/files/cve/CVE-2012-3748 CVE-2012-3748]
* [https://hackerone.com/reports/1350653 HackerOne report by m00nbsd (2021-09-24)]
* [https://packetstormsecurity.com/files/123088/ PSA 2013-0903-1]
* [http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2022-001.txt.asc NetBSD Security Advisory about CVE-2022-29867 (2022-05-04)]
* [https://www.exploit-db.com/exploits/28081/ Exploit PoC by Vitaliy Toropov]


==== Bug Description ====
==== Bug Description ====
By forcing the compare function to reduce the size of the array, trailing items will be written out of bounds (OOB write), leading to heap memory corruption.
The PlayStation 4 has a kernel PPPoE driver, that originates from NetBSD. This driver has a kernel heap overflow vulnerability, that an attacker can remotely trigger over the LAN, with the ability to control both the contents that are overflown and their sizes.


==== Exploit Implementation ====
Extract of NetBSD 8.3 changelog:
* [http://wololo.net/talk/viewtopic.php?p=368577 first POC for 1.76 PS4 by nas and Proxima]
<pre>
* [http://wololo.net/downloads/index.php/download/8230 mirror]
sys/net/if_pppoe.c 1.179
* [http://daxhordes.org/ps4_176/ps4_dump.html live test]
* [http://daxhordes.org/ps4_176/ps4_dump2.html livetest2]
* [http://daxhordes.org/ps4_176/ps4_rop2.html ROP2]
* [https://cturt.github.io/PS4-playground/ PS4 playground 1.76 by CTurt]
* [https://bitbucket.org/DaveeFTW/psvita-260-webkit/src/master/ PSVita 2.00-3.20 WebKit exploit]


==== Patched ====
pppoe(4): fix CVE-2022-29867 - discovery phase local network
'''Yes''' in 2.00 FW
mbuf corruption.
[martin, ticket #1740]


==== Tested ====
Do not allocate mbuf clusters when the caller (eroneously) asks
* Working on PS4 1.00-1.76 FW, AppleWebKit/531.3-536.26
for more than MCLBYTES size, instead fail the allocation.
* Might work on PS4 FW 0.930.020.


=== Possible WebKit vulnerabilities ===
When we have received multiple PADO offer packets in the discovery
phase, do not combine tags from different packets. We are supposed
to pick one PADO packet and continue session establishment with that.


Affecting WebKitGTK: CVE-2023-41074, CVE-2023-42917.
The second bug could cause code to trigger the first and create
invalid response packets and also overwrite data outside of
the allocated mbuf cluster.


== Usermode securities ==
Fixes CVE-2022-29867.
</pre>


=== Usermode ASLR ===
Diff after fix commit in NetBSD 8:
 
<source lang="C">
* Very old firmwares (<= 1.05) do not have ASLR enabled, but it was introduced sometime before firmware 1.70. "Address Space Layout Randomization" (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4.
--- src/sys/net/if_pppoe.c 2020/02/13 19:37:39 1.125.6.10
* To defeat usermode ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address.
+++ src/sys/net/if_pppoe.c 2022/05/04 15:36:35 1.125.6.11
 
@@ -1,4 +1,4 @@
=== Module imports table cleaned before execution ===
-/* $NetBSD: if_pppoe.c,v 1.125.6.10 2020/02/13 19:37:39 martin Exp $ */
 
+/* $NetBSD: if_pppoe.c,v 1.125.6.11 2022/05/04 15:36:35 sborrill Exp $ */
* Between 1.76 and 4.05, Sony did that to prevent WebKit exploiters from defeating usermode ASLR easily.
* Now we have to dump entire usermode sandboxed memory, and by studying it we can defeat ASLR:
/*-
1. Chose a function (ex: __stack_chk_fail) imported from libkernel.sprx by libSceWebkit2.sprx
  * Copyright (c) 2002, 2008 The NetBSD Foundation, Inc.
 
@@ -30,7 +30,7 @@
2. Read pointer contained at the address where the call is done
  */
 
3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module
#include <sys/cdefs.h>
 
-__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.125.6.10 2020/02/13 19:37:39 martin Exp $");
4. This result is LibKernel base address. This method works for any imported module.
+__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.125.6.11 2022/05/04 15:36:35 sborrill Exp $");
 
For FW >= 6.00, for web applications, libkernel.sprx has been replaced by libkernel_web.sprx and libSceWebKit2 by libSceNKWebKit.sprx. libkernel.sprx is still used by other applications.
#ifdef _KERNEL_OPT
 
#include "pppoe.h"
=== DEP / NX ===
@@ -871,6 +871,10 @@ breakbreak:;
 
}
* "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to usermode memory then executing it.
sc->sc_ac_cookie_len = ac_cookie_len;
* 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs).
memcpy(sc->sc_ac_cookie, ac_cookie, ac_cookie_len);
 
+ } else if (sc->sc_ac_cookie) {
=== JiT removed from webbrowser ===
+ free(sc->sc_ac_cookie, M_DEVBUF);
 
+ sc->sc_ac_cookie = NULL;
* On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched.
+ sc->sc_ac_cookie_len = 0;
* Checking the source code at [https://doc.dl.playstation.net/doc/ps4-oss/webkit.html ps4-oss], starting as early as FW 6.00, ENABLE_JIT=OFF for -DPORT=PlayStation4. It means that JIT functionality is completely removed from WebKit and there is no JIT coprocess that is allowed to request RWX memory to even attack. Even if there are JIT bugs that can lead us to request RWX memory in other platforms, we can't on the PS4 as there is no longer any JIT process. Unchecked all source codes, JIT process could have been removed earlier than 6.00. All exploits must use ROP.
}
* Workaround is to use ROP.
if (relay_sid) {
 
if (sc->sc_relay_sid)
=== Syscalls removed ===
@@ -886,6 +890,10 @@ breakbreak:;
 
}
* See the PS4 [[Syscalls]] list.
sc->sc_relay_sid_len = relay_sid_len;
 
memcpy(sc->sc_relay_sid, relay_sid, relay_sid_len);
=== Syscall 0 disabled i.e Error Kernel: The application directly issues a syscall instruction (24) ===
+ } else if (sc->sc_relay_sid) {
+ free(sc->sc_relay_sid, M_DEVBUF);
+ sc->sc_relay_sid = NULL;
+ sc->sc_relay_sid_len = 0;
}
memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest);
callout_stop(&sc->sc_timeout);
@@ -1313,6 +1321,9 @@ pppoe_get_mbuf(size_t len)
{
struct mbuf *m;
+ if (len + sizeof(struct ether_header) > MCLBYTES)
+ return NULL;
+
MGETHDR(m, M_DONTWAIT, MT_DATA);
if (m == NULL)
return NULL;
</source>


* Between 2.00 and 2.57, SCE has removed system call 0, so we can no longer call any syscall we want by specifying the call number in the rax register.
==== Exploit Implementation ====
* Doing so now crashes the app and gives error CE-34878-0, SCE_KERNEL_ABORT_REASON_SYSTEM_ILLEGAL_FUNCTION_CALL, with the message "Kernel: The application directly issues a syscall instruction (24)".
* PoC (poc.c) by m00nbsd not disclosed publicly
* We now have to use wrappers provided to us from the libkernel / libkernel_web / libkernel_sys modules to access system calls.


=== bpf_write function stripped out of the kernel ===
==== Patched ====
'''Yes''' in 9.03 FW according to Specter by diffing PS4 9.00 and 9.03 kernels
----


* On 4.70, bpfwrite() was stripped out of the kernel entirely to patch kernel vulnerability exploited in 4.55 kexploit.
=== FW <= 9.00 - exFAT driver heap-based buffer overflow ===


=== bpf_open function blocked for unprivileged processes ===
==== Credits ====
* 2021-09-15 TheFloW for finding the vulnerability
* 2021-12-02 zecoxao for advicing to exploit the vulnerability after diffing PS4 9.00 and 9.03 kernels
* 2021-12-13 ChendoChap, Znullptr, Specter for PS4 9.00 kernel exploit implementation release


* On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF.
==== Analysis ====
* [https://twitter.com/notzecoxao/status/1466463051872448521 Vulnerability adviced by zecoxao for exploitation (2021-12-02)]
* [https://hackerone.com/reports/1340942 TheFloW's report on HackerOne (2021-09-15), disclosed on 2022-09-21]


=== bpf_ioctl function blocked or removed ===
==== Bug Description ====
The PS4 kernel exFAT driver has a heap-based buffer overflow vulnerability that can be triggered by inserting a malicious USB storage device in PS4 in addition to having usermode code execution. Exploitation requires to flash a crafted exFAT image to a common USB storage device.


* On FW 5.50+, opening BPF is still possible in less sandboxed apps like TestKit/DevKits fSELFs. But this is useless because ioctl does not work.
==== Exploit Implementation ====
* [https://github.com/ChendoChap/pOOBs4 ChendoChap's implementation for PS4 9.00 (2021-12-13)]


=== Device access blocked/removed from webbrowser ===
==== Patched ====
'''Yes''' in PS4 9.03 FW and PS5 4.50 FW
----


* Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from the web browser.
=== FW <= 7.55 - IP6_EXTHDR_CHECK Double Free (CVE-2020-9892) ===


=== Pointer poisoning in WebKit on 6.xx firmwares ===
==== Credits ====
 
* 2019-09-15 tuexen for finding the FreeBSD vulnerability [https://reviews.freebsd.org/D21664]
* For select types implemented by WebKit (such as JSC::JSFunction), certain pointer fields are XOR'ed by a cryptographic key generated at runtime. The key is generated once every process launch, one must recover it to unpoison the pointers.
* 2020-07-24 TheFloW for finding CVE-2020-9892 in XNU
 
* 2020-07-26 TheFloW for porting CVE-2020-9892 to PS4
== Kernel Exploits ==
* 2020-07-27 TheFloW for publishing publicly a PoC leading to code execution on XNU. [https://twitter.com/theflow0/status/1324687305018408961]
 
* 2021-01-12 TheFloW for disclosing publicly the PS4 vulnerability. [https://hackerone.com/reports/943231]
=== FW <= 11.52 - Double free in bnet_netevent_set_queue ===
* 2021-01-20 sleirsgoevy for making a first working exploit for FreeBSD 9 [https://twitter.com/sleirsgoevy/status/1351689713564979200]
 
* 2021-03-03 sleirsgoevy for making a second working exploit for FreeBSD 9 [https://twitter.com/sleirsgoevy/status/1367098280736399368]
==== Credits ====
* 2021-03-12 sleirsgoevy for making the first public usable exploit for PS4 7.50-7.55 (https://twitter.com/sleirsgoevy/status/1370481212813348865)
* Anonymous for sharing 11.52 and 12.00 PS4 kernel dumps.
* 2024-09-27 D-Link Turtle for diffing 11.52 and 12.00 PS4 kernel dumps.
* 2024-10-04 SlidyBat for figuring out the bug in bnet and its impact.


==== Analysis ====
==== Analysis ====
* [https://x.com/iMrDJAi/status/1842306232125964473/photo/1 Analysis by abc (2024-10-04)]
* [https://reviews.freebsd.org/D21664 Fix handling of Hop-by-Hop options over the loopback interface commits review (2019-09-15 to 2020-05-07)]
* [https://support.apple.com/en-us/HT211288 Apple iOS 13.6 and iPadOS 13.6 Security Update (2020-07-24)]
* [https://support.apple.com/en-us/HT211289 Apple macOS Catalina 10.15.6 Security Update (2020-07-24)]
* [https://hackerone.com/reports/943231 TheFloW's report of the exploit with undisclosed PS4 and FreeBSD 9 PoCs]
* [https://github.com/google/security-research/security/advisories/GHSA-gxcr-cw4q-9q78 TheFloW's writeup and PoC for XNU (2020-07-26)]
* [https://github.com/freebsd/freebsd-src/commit/68e0e5a673c5026c68dba62314a2e58ad1533cfd#diff-816eb9feee4ece60d3c6e8933a75baf4fcfbdce0284500d86ac80e24827a19c8 Vulnerability adviced by TheFloW for exploitation (2018-02-05)]


==== Bug Description ====
==== Bug Description ====
A double free can happen by racing calls to bnet_netevent_set_queue and bnet_netevent_unset_queue.
Memory corruption can be achieved by sending fragmented IPv6 packets to loopback interface due to poor and inconsistent use of IP6_EXTHDR_CHECK.


The lack of mutexes allowed double free as fdrop is called unconditionally in bnet_netevent_unset_queue.
The macro IP6_EXTHDR_CHECK can free the mbuf if the packet is sent to loopback interface. This fact is not considered in dest6_input(), frag6_input() and more. For example in dest6_input(), the double pointer is not updated.


See also PS Vita SceNetPs kernel module that uses similar bnet functions.
Hence, when parsing next headers, the mbuf can be free'd once again, leading to a double free which behaves like a use-after-free when we allocate mbuf's again.
 
Normally, this path would not be triggerable, because sending to loopback interface requires SOCK_RAW root privileges. However, for some reason on the PS4 SOCK_RAW sockets can be opened in Webkit process! Moreover, CelesteBlue confirmed that SOCK_RAW sockets can also be opened in PS4 Kit fSELF.
 
According to TheFloW, the reliability of the FreeBSD 9 PoC is very high, around 80%, whereas the PS4 PoC's is not very high, he guesses around 20%.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/google/security-research/security/advisories/GHSA-gxcr-cw4q-9q78 TheFloW's writeup and PoC for XNU (2020-07-27)]
* [https://gist.github.com/sleirsgoevy/ff591bfdc3a6f7573ed2388b018b31ec sleirsgoevy's first exploit PoC for FreeBSD 9 (2021-01-20)]
* [https://asciinema.org/a/385584 Demonstration video of sleirsgoevy's first exploit PoC for FreeBSD 9 (2021-01-20)]
* [https://gist.github.com/CelesteBlue-dev/de46d9e94823f0a6cf4b3b40ad635c14 Specter's kernel panic PoC for PS4 Web browser (2021-01-15)]
* [https://gist.github.com/CelesteBlue-dev/16303965ffea7e0a2c7c1d763cc721ec CelesteBlue's kernel panic PoC for PS4 Kit fSELF (2021-01-15)]
* [https://github.com/dayzerosec/PS4-Kernel-Exploit-Stream WiP exploit code by Specter and tihmstar (2021-02-24)]
* [https://gist.github.com/sleirsgoevy/35722572b0096f9acfd76a97b5678bed sleirsgoevy's second exploit PoC for FreeBSD 9 (2021-03-03)]
* [https://asciinema.org/a/396409 Demonstration video of sleirsgoevy's second exploit PoC for FreeBSD 9 (2021-03-03)]
* [https://github.com/sleirsgoevy/ps4jb2/blob/75x/src/jb.c sleirsgoevy's implementation for PS4 7.5x (2021-03-12)]
* [https://gist.github.com/Cryptogenic/448fd98813ab5a93182fb9620c013e17 Specter's implementation for FreeBSD 9 (2021-03-24)]


==== Patched ====
==== Patched ====
'''Yes''' in 12.00 FW. Maybe not working at all on PS5.
'''Yes''' in 8.00 FW
 
The bug was patched in PS4 FW 12.00 by adding some mutexes in bnet_netevent functions
----
----


=== FW <= 11.00 - Remote vulnerabilities in spp (yielding kernel ASLR defeat) (CVE-2006-4304 and no-CVE) ===
=== FW <= 7.02 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457) ===


==== Credits ====
==== Credits ====
* 2006-08-23 Martin Husemann, Pavel Cahyna for discovering the first spp bug (CVE-2006-4304) on FreeBSD 4.11-6.1.
* 2018-08-18 up to 2020-07-06 Fire30 for finding and keeping the vulnerability as a private 0day for it not to be patched by SIE. [https://twitter.com/Fire30_/status/1280228173888831490]
* 2023-09-22 TheFloW for discovering that PS4 and PS5 are vulnerable to CVE-2006-4304, discovering second spp bug, and chaining them together.
* 2020-07-06 TheFloW for publishing publicly a PoC leading to code execution on FreeBSD. [https://twitter.com/theflow0/status/1280224554393178122]
* 2024-01-27 anonymous for reporting publicly CVE-2006-4304 as working on PS4 and PS5. See [https://i0.wp.com/wololo.net/wagic/wp-content/uploads/2024/02/initial_claims.png?w=603&ssl=1] and [https://ibb.co/sVb39Zj].
* sleirsgoevy and ChendoChap for porting the PoC to PS4 and chaining it with the 6.72 and 7.02 WebKit exploits.
* 2024-03 iMrDJAi for porting CVE-2006-4304 to PS4 and PS5.
* SIE for not patching this vulnerability on PS5 even when patched on PS4.
* 2024-04-25 TheFloW for disclosing his HackerOne report including the second spp bug description.
* TheFlow for announcing that PS5 kernel was exploited: [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)] and later that it was that same vulnerability that was present in PS5 FW 3.00-4.51.
* 2024-04-30 TheFloW for releasing his exploit code for PS4 9.00 and 11.00.


==== Analysis ====
==== Analysis ====
* [https://www.freebsd.org/security/advisories/FreeBSD-SA-06:18.ppp.asc FreeBSD Security Advisory for CVE-2006-4304 (2006-08-23)]
* [https://hackerone.com/reports/826026 TheFloW's hackerone report of the PS4 kernel exploit with a FreeBSD 9-12 PoC]
* [https://hackerone.com/reports/2177925 HackerOne report about Remote vulnerabilities in spp by TheFloW (2023-09-22)]
* [https://www.freebsd.org/security/advisories/FreeBSD-SA-20:20.ipv6.asc FreeBSD Security Advisory FreeBSD-SA-20:20.ipv6]
* [https://romhack.io/wp-content/uploads/sites/3/2024/10/Andy-Nguyen-PlayStation-4-Remote-Kernel-Exploitation-RomHack-2024.pdf Slides of TheFloW's presentation at RomHack 2024 (2024-09-28)]
* [https://www.freebsd.org/security/patches/SA-20:20/ipv6.patch FreeBSD patch for FreeBSD-SA-20:20.ipv6]
* [https://www.youtube.com/watch?v=LRdbnGkk7JA Video of TheFloW's presentation at RomHack 2024 (2024-09-28)]
* [https://hackerone.com/reports/1441103 TheFloW's hackerone report of the PS5 kernel exploit]


==== Bug Description ====
==== Bug Description ====
A malicious PPPoE server can cause denial-of-service or remote code execution in kernel context on the PS4/PS5. It does not require any usermode code execution to be triggered. There are two vulnerabilities that can be chained together to cause remote kernel Denial of Service, kernel ASLR defeat or kernel code execution : Heap buffer overwrite and overread in sppp_lcp_RCR and sppp_ipcp_RCR (CVE-2006-4304) and Integer underflow in sppp_pap_input leading to heap-buffer overread (no-CVE).
Due to missing locks in option IPV6_2292PKTOPTIONS of setsockopt, it is possible to race and free the struct ip6_pktopts buffer, while it is being handled by ip6_setpktopt. This structure contains pointers (ip6po_pktinfo) that can be hijacked to obtain arbitrary kernel R/W primitives. As a consequence, it is easy to have kernel code execution. This vulnerability is reachable from WebKit sandbox and is available in the latest FW, that is 7.02.


The PS4/PS5 must be connected using an ethernet cable to a device able to trigger PPPoE requests and analyze the responses.
Another description: There is a race and use-after-free vulnerability in the FreeBSD kernel IPv6 socket handling. A missing synchronization lock in the `IPV6_2292PKTOPTIONS` option handling in `setsockopt` permits racing `ip6_setpktopt` access to a freed `ip6_pktopts` struct. This exploit overwrites the `ip6po_pktinfo` pointer of a `ip6_pktopts` struct in freed memory to achieve arbitrary kernel read/write.


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/iMrDJAi/FreeBSD9-CVE-2006-4304 CVE-2006-4304 PoC for FreeBSD9 by iMrDJAi (2024-04-07)]
* [https://web.archive.org/web/20221114191136/https://hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com/Y13EyQCGKEqxH8PpJgFKh5uY?response-content-disposition=attachment%3B%20filename%3D%22exploit.c%22%3B%20filename%2A%3DUTF-8%27%27exploit.c&response-content-type=text%2Fx-c%2B%2Bsrc&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAQGK6FURQZUKBWFOX%2F20221114%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20221114T190929Z&X-Amz-Expires=3600&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEOL%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLXdlc3QtMiJGMEQCIFEUV16y5O0IfDfbCmJ%2F6CNBjc6kmS%2BLdyYBPFSMIVMSAiADc6fvThSy0kmHFzOgAuurPiybfKCotgtPfJV7%2BW%2BFISrVBAjb%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAMaDDAxMzYxOTI3NDg0OSIMz0dZbvRJU9aGlVs8KqkENy%2FVEqF6TYz2HV%2F9sZELOz%2BpxTJWSgQJD3vCru6Qzggs8Xgdri4orYmQzZKvAvhNa2npS%2F86NUBQwqurS2QL5yc7Sb0ZZn%2FcJnIA%2BBsk5lwmZyKy8WAo4Lug8AtID3L8mD5RRFBojcoyIvpbxXHakUn95b%2F44fV4W%2BvufW9YhsYK1FuM%2F0B6bRNUec5ny%2Fqla1KwOnjv7SINSCxdufU8sC1zTQ9RFNsYtNsOMDFPOQAR%2FAXomotb63jvMJROdCkcvoGPfozkJjYg5atl3d44fO%2FSfyYteUZB%2BIJwchX1HlAVK2vxrPuO%2FJTN9XzJvQsHjJFluix9rxBPmpROxI%2Ffi6NuDs0I2uv0%2BvCuGRpqcSqtXUKc3TRb5nQoNUsJDcMF9hXRio37LorziEo6N5Q7sDsygd0vOq6lNQqMZh8gyOwSpcSfsE9U0uMTIUXV9in8%2BF4k3F%2FLH4HzRpDIPJaSm%2FBGKlrFiTXdVExPGYkgJHdEIPL%2FPykEOaS3JXXcZlTrV7QQEUuq5a4gEZad8WHShcDOHoOujd5GTJmpctChhpDI3SrXdH%2BN%2B4h2venOtXxjRoYKemEWa4LFrj7rvynFDv2jijqCHdkMnGJo3bdGns7rEdPaeHSyVZSiWAY1MWwuYFYRkZIxq%2BlILvy1Mitp%2FEe70ZQ63pmir99p8dGiOYNKe%2FFoJI6zZm4uYVa%2Fxuwf3sD8Je6plXBy4%2BaPzbkQ6EY5BxGr%2FSdMnzDTiMqbBjqqAZeQf4BVmDmE50Upkzo0uDY9tVuKTV7pmJ8dSXhwZbOE5bjaUYBn6fgRxYFOfSf3QX6u1VSnbyDicpmDYkt4yuz%2BU7R%2Bx68pJY1%2BQyb7aGRmVSrm7lrTwGqz%2BcsOohl6cwONvLgfHPhztGD1qDRbS2cjXGcF30AR1cS0LbLq6zax8x2SnH8MfnGoAY3KI%2FTMRRzWA7qMETPrAEWYzRgGzqLkk%2FddHKZBLC4U&X-Amz-SignedHeaders=host&X-Amz-Signature=4a8fe44640d605e3ea252fe41d6b7d83c72aa082c7eb17e3d11d85b32d609b50 TheFloW's PoC for FreeBSD 9 and 12]
* [https://gist.github.com/iMrDJAi/847a4f2eeff9669657ffcdf85ac7a901 CVE-2006-4304 PoC for PS4 and PS5 by iMrDJAi (2024-04-07)]
* [https://github.com/sleirsgoevy/ps4jb PS4 6.72-7.02 WebKit + Kernel Exploit implementation by sleirsgoevy]
* [https://github.com/TheOfficialFloW/PPPwn spp exploit for PS4 9.00 and 11.00 by TheFloW (2024-04-30)]
* [https://github.com/ChendoChap/ps4-ipv6-uaf PS4 5.05-7.02 WebKit + Kernel Exploit implementation by ChendoChap]


==== Patched ====
==== Patched ====
'''Yes''' in 11.02 FW
'''Yes''' in PS4 7.50 FW and in PS5 5.00 or 5.02 FW. Not working in PS5 FWs <= 2.50.
----
----


=== FW <= 9.00 - PPPoE driver remote buffer overflow (CVE-2022-29867) ===
=== FW <= 5.07 - BPF Race Condition (Yielding Double Free()) ===


==== Credits ====
==== Analysis ====
* 2021-09-24 m00nbsd for finding the vulnerability
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%205.05%20BPF%20Double%20Free%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 5.05 BPF Race Condition]
* 2022-05-04 martin of NetBSD for fixing the vulnerability publicly in NetBSD 8 and 9
* 2022-05-11 m00nbsd for disclosing the vulnerability publicly on HackerOne
 
==== Analysis ====
* [https://hackerone.com/reports/1350653 HackerOne report by m00nbsd (2021-09-24)]
* [http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2022-001.txt.asc NetBSD Security Advisory about CVE-2022-29867 (2022-05-04)]


==== Bug Description ====
==== Bug Description ====
The PlayStation 4 has a kernel PPPoE driver, that originates from NetBSD. This driver has a kernel heap overflow vulnerability, that an attacker can remotely trigger over the LAN, with the ability to control both the contents that are overflown and their sizes.
Due to improper locking, two threads can enter the BPF SETWF ioctl command handler. While the bug is similar to that of 4.55, the method of attack is slightly different. Since write() was removed for BPF in 4.70, instead of triggering a use-after-free with write() - SETWF is ran in parallel via threading. Eventually, both calls will copy the same pointer to the stack, leading to both threads free()'ing the same pointer, poisoning the freelist. This can later be leveraged via heap spraying to corrupt heap memory to obtain arbitrary code execution in supervisor mode (ring0).


Extract of NetBSD 8.3 changelog:
==== Exploit Implementation ====
<pre>
* [http://crack.bargains/505k/ PS4 5.05 WebKit + Kernel Exploit]
sys/net/if_pppoe.c 1.179
* [https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit PS4 5.05 WebKit + Kernel Exploit Source]


pppoe(4): fix CVE-2022-29867 - discovery phase local network
==== Patched ====
mbuf corruption.
'''Yes''' in 5.50 FW
[martin, ticket #1740]
----


Do not allocate mbuf clusters when the caller (eroneously) asks
=== FW <= 4.55 - BPF Race Condition (Yielding UaF) ===
for more than MCLBYTES size, instead fail the allocation.


When we have received multiple PADO offer packets in the discovery
==== Analysis ====
phase, do not combine tags from different packets. We are supposed
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 4.55 BPF Race Condition]
to pick one PADO packet and continue session establishment with that.
 
==== Bug Description ====
Due to improper locking, two threads can enter the BPF ioctl command handlers for setting a new write filter (SETWF) and setting a filter (SETIF). Both threads will reference the same pointer. In specially crafted situations, one thread could free() this pointer while the other thread executes it as a filter post-validation. This allows an unprivileged user to obtain an out-of-bounds (OOB) write on the stack, leading to arbitrary code execution in supervisor mode (ring0).
 
==== Exploit Implementation ====
[http://crack.bargains/455/ PS4 4.55 WebKit + Kernel Exploit]<br/>
[https://github.com/Cryptogenic/PS4-4.55-Kernel-Exploit PS4 4.55 WebKit + Kernel Exploit Source]


The second bug could cause code to trigger the first and create
==== Patched ====
invalid response packets and also overwrite data outside of
'''Yes''' in 4.70 FW
the allocated mbuf cluster.
----


Fixes CVE-2022-29867.
=== FW <= 6.00 ?6.02? - sys_getcontext Information Leak (kASLR defeat) (CVE-2018-17155) ===
</pre>


Diff after fix commit in NetBSD 8:
==== Analysis ====
<source lang="C">
* https://www.cvedetails.com/cve/CVE-2018-17155/
--- src/sys/net/if_pppoe.c 2020/02/13 19:37:39 1.125.6.10
* coming soon by CelesteBlue
+++ src/sys/net/if_pppoe.c 2022/05/04 15:36:35 1.125.6.11
 
@@ -1,4 +1,4 @@
==== Bug Description ====
-/* $NetBSD: if_pppoe.c,v 1.125.6.10 2020/02/13 19:37:39 martin Exp $ */
System call 421 or sys_getcontext() initializes the structure pointed at by ucp to the currently active context. The vulnerability is, some areas of memory copied out are not initialized, and thus the function leaks memory at certain spots. This vector was patched in 6.20, as now before the buffer is used it is initialized to 0 via bzero().
+/* $NetBSD: if_pppoe.c,v 1.125.6.11 2022/05/04 15:36:35 sborrill Exp $ */
 
==== Exploit Implementation ====
/*-
* QuickHEN by CelesteBlue (v2 not released yet)
  * Copyright (c) 2002, 2008 The NetBSD Foundation, Inc.
* KitHEN by CelesteBlue (not released yet)
@@ -30,7 +30,7 @@
 
  */
==== Patched ====
'''Yes''' somewhere between 6.00 and 6.20 FW
#include <sys/cdefs.h>
----
-__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.125.6.10 2020/02/13 19:37:39 martin Exp $");
 
+__KERNEL_RCSID(0, "$NetBSD: if_pppoe.c,v 1.125.6.11 2022/05/04 15:36:35 sborrill Exp $");
=== FW <= 4.07 - sys_thr_get_ucontext Information Leak (kASLR defeat) ===
 
#ifdef _KERNEL_OPT
==== Analysis ====
#include "pppoe.h"
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md#vector-sys_thr_get_ucontext Specter's Writeup]
@@ -871,6 +871,10 @@ breakbreak:;
 
}
==== Bug Description ====
sc->sc_ac_cookie_len = ac_cookie_len;
System call 634 or sys_thr_get_ucontext() allows to obtain information on a given thread. The vulnerability is, some areas of memory copied out are not initialized, and thus the function leaks memory at certain spots. This vector was patched in 4.50, as now before the buffer is used it is initialized to 0 via bzero().
memcpy(sc->sc_ac_cookie, ac_cookie, ac_cookie_len);
 
+ } else if (sc->sc_ac_cookie) {
==== Exploit Implementation ====
+ free(sc->sc_ac_cookie, M_DEVBUF);
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]
+ sc->sc_ac_cookie = NULL;
 
+ sc->sc_ac_cookie_len = 0;
==== Patched ====
}
'''Yes''' in 4.50 FW
if (relay_sid) {
----
if (sc->sc_relay_sid)
@@ -886,6 +890,10 @@ breakbreak:;
}
sc->sc_relay_sid_len = relay_sid_len;
memcpy(sc->sc_relay_sid, relay_sid, relay_sid_len);
+ } else if (sc->sc_relay_sid) {
+ free(sc->sc_relay_sid, M_DEVBUF);
+ sc->sc_relay_sid = NULL;
+ sc->sc_relay_sid_len = 0;
}
memcpy(&sc->sc_dest, eh->ether_shost, sizeof sc->sc_dest);
callout_stop(&sc->sc_timeout);
@@ -1313,6 +1321,9 @@ pppoe_get_mbuf(size_t len)
{
struct mbuf *m;
+ if (len + sizeof(struct ether_header) > MCLBYTES)
+ return NULL;
+
MGETHDR(m, M_DONTWAIT, MT_DATA);
if (m == NULL)
return NULL;
</source>


==== Exploit Implementation ====
=== FW <= 4.05 - NamedObj Type Confusion (Yielding UaF) ===
* PoC (poc.c) by m00nbsd not disclosed publicly


==== Patched ====
==== Credits ====
'''Yes''' in 9.03 FW according to Specter by diffing PS4 9.00 and 9.03 kernels
* Chaitlin Tech for having been the first to show they had pwned PS4 FW 4.01 at Geekpwn convention. (2016-10-24)
----
 
=== FW <= 9.00 - exFAT driver heap-based buffer overflow ===
 
==== Credits ====
* 2021-09-15 TheFloW for finding the vulnerability
* 2021-12-02 zecoxao for advicing to exploit the vulnerability after diffing PS4 9.00 and 9.03 kernels
* 2021-12-13 ChendoChap, Znullptr, Specter for PS4 9.00 kernel exploit implementation release
 
==== Analysis ====
* [https://twitter.com/notzecoxao/status/1466463051872448521 Vulnerability adviced by zecoxao for exploitation (2021-12-02)]
* [https://hackerone.com/reports/1340942 TheFloW's report on HackerOne (2021-09-15), disclosed on 2022-09-21]
 
==== Bug Description ====
The PS4 kernel exFAT driver has a heap-based buffer overflow vulnerability that can be triggered by inserting a malicious USB storage device in PS4 in addition to having usermode code execution. Exploitation requires to flash a crafted exFAT image to a common USB storage device.
 
==== Exploit Implementation ====
* [https://github.com/ChendoChap/pOOBs4 ChendoChap's implementation for PS4 9.00 (2021-12-13)]
 
==== Patched ====
'''Yes''' in PS4 9.03 FW and PS5 4.50 FW
----
 
=== FW <= 7.55 - IP6_EXTHDR_CHECK Double Free (CVE-2020-9892) ===
 
==== Credits ====
* 2019-09-15 tuexen for finding the FreeBSD vulnerability [https://reviews.freebsd.org/D21664]
* 2020-07-24 TheFloW for finding CVE-2020-9892 in XNU
* 2020-07-26 TheFloW for porting CVE-2020-9892 to PS4
* 2020-07-27 TheFloW for publishing publicly a PoC leading to code execution on XNU. [https://twitter.com/theflow0/status/1324687305018408961]
* 2021-01-12 TheFloW for disclosing publicly the PS4 vulnerability. [https://hackerone.com/reports/943231]
* 2021-01-20 sleirsgoevy for making a first working exploit for FreeBSD 9 [https://twitter.com/sleirsgoevy/status/1351689713564979200]
* 2021-03-03 sleirsgoevy for making a second working exploit for FreeBSD 9 [https://twitter.com/sleirsgoevy/status/1367098280736399368]
* 2021-03-12 sleirsgoevy for making the first public usable exploit for PS4 7.50-7.55 (https://twitter.com/sleirsgoevy/status/1370481212813348865)
 
==== Analysis ====
* [https://reviews.freebsd.org/D21664 Fix handling of Hop-by-Hop options over the loopback interface commits review (2019-09-15 to 2020-05-07)]
* [https://support.apple.com/en-us/HT211288 Apple iOS 13.6 and iPadOS 13.6 Security Update (2020-07-24)]
* [https://support.apple.com/en-us/HT211289 Apple macOS Catalina 10.15.6 Security Update (2020-07-24)]
* [https://hackerone.com/reports/943231 TheFloW's report of the exploit with undisclosed PS4 and FreeBSD 9 PoCs]
* [https://github.com/google/security-research/security/advisories/GHSA-gxcr-cw4q-9q78 TheFloW's writeup and PoC for XNU (2020-07-26)]
* [https://github.com/freebsd/freebsd-src/commit/68e0e5a673c5026c68dba62314a2e58ad1533cfd#diff-816eb9feee4ece60d3c6e8933a75baf4fcfbdce0284500d86ac80e24827a19c8 Vulnerability adviced by TheFloW for exploitation (2018-02-05)]
 
==== Bug Description ====
Memory corruption can be achieved by sending fragmented IPv6 packets to loopback interface due to poor and inconsistent use of IP6_EXTHDR_CHECK.
 
The macro IP6_EXTHDR_CHECK can free the mbuf if the packet is sent to loopback interface. This fact is not considered in dest6_input(), frag6_input() and more. For example in dest6_input(), the double pointer is not updated.
 
Hence, when parsing next headers, the mbuf can be free'd once again, leading to a double free which behaves like a use-after-free when we allocate mbuf's again.
 
Normally, this path would not be triggerable, because sending to loopback interface requires SOCK_RAW root privileges. However, for some reason on the PS4 SOCK_RAW sockets can be opened in Webkit process! Moreover, CelesteBlue confirmed that SOCK_RAW sockets can also be opened in PS4 Kit fSELF.
 
According to TheFloW, the reliability of the FreeBSD 9 PoC is very high, around 80%, whereas the PS4 PoC's is not very high, he guesses around 20%.
 
==== Exploit Implementation ====
* [https://github.com/google/security-research/security/advisories/GHSA-gxcr-cw4q-9q78 TheFloW's writeup and PoC for XNU (2020-07-27)]
* [https://gist.github.com/sleirsgoevy/ff591bfdc3a6f7573ed2388b018b31ec sleirsgoevy's first exploit PoC for FreeBSD 9 (2021-01-20)]
* [https://asciinema.org/a/385584 Demonstration video of sleirsgoevy's first exploit PoC for FreeBSD 9 (2021-01-20)]
* [https://gist.github.com/CelesteBlue-dev/de46d9e94823f0a6cf4b3b40ad635c14 Specter's kernel panic PoC for PS4 Web browser (2021-01-15)]
* [https://gist.github.com/CelesteBlue-dev/16303965ffea7e0a2c7c1d763cc721ec CelesteBlue's kernel panic PoC for PS4 Kit fSELF (2021-01-15)]
* [https://github.com/dayzerosec/PS4-Kernel-Exploit-Stream WiP exploit code by Specter and tihmstar (2021-02-24)]
* [https://gist.github.com/sleirsgoevy/35722572b0096f9acfd76a97b5678bed sleirsgoevy's second exploit PoC for FreeBSD 9 (2021-03-03)]
* [https://asciinema.org/a/396409 Demonstration video of sleirsgoevy's second exploit PoC for FreeBSD 9 (2021-03-03)]
* [https://github.com/sleirsgoevy/ps4jb2/blob/75x/src/jb.c sleirsgoevy's implementation for PS4 7.5x (2021-03-12)]
* [https://gist.github.com/Cryptogenic/448fd98813ab5a93182fb9620c013e17 Specter's implementation for FreeBSD 9 (2021-03-24)]
 
==== Patched ====
'''Yes''' in 8.00 FW
----
 
=== FW <= 7.02 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457) ===
 
==== Credits ====
* 2018-08-18 up to 2020-07-06 Fire30 for finding and keeping the vulnerability as a private 0day for it not to be patched by SIE. [https://twitter.com/Fire30_/status/1280228173888831490]
* 2020-07-06 TheFloW for publishing publicly a PoC leading to code execution on FreeBSD. [https://twitter.com/theflow0/status/1280224554393178122]
* sleirsgoevy and ChendoChap for porting the PoC to PS4 and chaining it with the 6.72 and 7.02 WebKit exploits.
* SIE for not patching this vulnerability on PS5 even when patched on PS4.
* TheFlow for announcing that PS5 kernel was exploited: [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)] and later that it was that same vulnerability that was present in PS5 FW 3.00-4.51.
 
==== Analysis ====
* [https://hackerone.com/reports/826026 TheFloW's hackerone report of the PS4 kernel exploit with a FreeBSD 9-12 PoC]
* [https://www.freebsd.org/security/advisories/FreeBSD-SA-20:20.ipv6.asc FreeBSD Security Advisory FreeBSD-SA-20:20.ipv6]
* [https://www.freebsd.org/security/patches/SA-20:20/ipv6.patch FreeBSD patch for FreeBSD-SA-20:20.ipv6]
* [https://hackerone.com/reports/1441103 TheFloW's hackerone report of the PS5 kernel exploit]
 
==== Bug Description ====
Due to missing locks in option IPV6_2292PKTOPTIONS of setsockopt, it is possible to race and free the struct ip6_pktopts buffer, while it is being handled by ip6_setpktopt. This structure contains pointers (ip6po_pktinfo) that can be hijacked to obtain arbitrary kernel R/W primitives. As a consequence, it is easy to have kernel code execution. This vulnerability is reachable from WebKit sandbox and is available in the latest FW, that is 7.02.
 
Another description: There is a race and use-after-free vulnerability in the FreeBSD kernel IPv6 socket handling. A missing synchronization lock in the `IPV6_2292PKTOPTIONS` option handling in `setsockopt` permits racing `ip6_setpktopt` access to a freed `ip6_pktopts` struct. This exploit overwrites the `ip6po_pktinfo` pointer of a `ip6_pktopts` struct in freed memory to achieve arbitrary kernel read/write.
 
==== Exploit Implementation ====
* [https://web.archive.org/web/20221114191136/https://hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com/Y13EyQCGKEqxH8PpJgFKh5uY?response-content-disposition=attachment%3B%20filename%3D%22exploit.c%22%3B%20filename%2A%3DUTF-8%27%27exploit.c&response-content-type=text%2Fx-c%2B%2Bsrc&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAQGK6FURQZUKBWFOX%2F20221114%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20221114T190929Z&X-Amz-Expires=3600&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEOL%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLXdlc3QtMiJGMEQCIFEUV16y5O0IfDfbCmJ%2F6CNBjc6kmS%2BLdyYBPFSMIVMSAiADc6fvThSy0kmHFzOgAuurPiybfKCotgtPfJV7%2BW%2BFISrVBAjb%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAMaDDAxMzYxOTI3NDg0OSIMz0dZbvRJU9aGlVs8KqkENy%2FVEqF6TYz2HV%2F9sZELOz%2BpxTJWSgQJD3vCru6Qzggs8Xgdri4orYmQzZKvAvhNa2npS%2F86NUBQwqurS2QL5yc7Sb0ZZn%2FcJnIA%2BBsk5lwmZyKy8WAo4Lug8AtID3L8mD5RRFBojcoyIvpbxXHakUn95b%2F44fV4W%2BvufW9YhsYK1FuM%2F0B6bRNUec5ny%2Fqla1KwOnjv7SINSCxdufU8sC1zTQ9RFNsYtNsOMDFPOQAR%2FAXomotb63jvMJROdCkcvoGPfozkJjYg5atl3d44fO%2FSfyYteUZB%2BIJwchX1HlAVK2vxrPuO%2FJTN9XzJvQsHjJFluix9rxBPmpROxI%2Ffi6NuDs0I2uv0%2BvCuGRpqcSqtXUKc3TRb5nQoNUsJDcMF9hXRio37LorziEo6N5Q7sDsygd0vOq6lNQqMZh8gyOwSpcSfsE9U0uMTIUXV9in8%2BF4k3F%2FLH4HzRpDIPJaSm%2FBGKlrFiTXdVExPGYkgJHdEIPL%2FPykEOaS3JXXcZlTrV7QQEUuq5a4gEZad8WHShcDOHoOujd5GTJmpctChhpDI3SrXdH%2BN%2B4h2venOtXxjRoYKemEWa4LFrj7rvynFDv2jijqCHdkMnGJo3bdGns7rEdPaeHSyVZSiWAY1MWwuYFYRkZIxq%2BlILvy1Mitp%2FEe70ZQ63pmir99p8dGiOYNKe%2FFoJI6zZm4uYVa%2Fxuwf3sD8Je6plXBy4%2BaPzbkQ6EY5BxGr%2FSdMnzDTiMqbBjqqAZeQf4BVmDmE50Upkzo0uDY9tVuKTV7pmJ8dSXhwZbOE5bjaUYBn6fgRxYFOfSf3QX6u1VSnbyDicpmDYkt4yuz%2BU7R%2Bx68pJY1%2BQyb7aGRmVSrm7lrTwGqz%2BcsOohl6cwONvLgfHPhztGD1qDRbS2cjXGcF30AR1cS0LbLq6zax8x2SnH8MfnGoAY3KI%2FTMRRzWA7qMETPrAEWYzRgGzqLkk%2FddHKZBLC4U&X-Amz-SignedHeaders=host&X-Amz-Signature=4a8fe44640d605e3ea252fe41d6b7d83c72aa082c7eb17e3d11d85b32d609b50 TheFloW's PoC for FreeBSD 9 and 12]
* [https://github.com/sleirsgoevy/ps4jb PS4 6.72-7.02 WebKit + Kernel Exploit implementation by sleirsgoevy]
* [https://github.com/ChendoChap/ps4-ipv6-uaf PS4 5.05-7.02 WebKit + Kernel Exploit implementation by ChendoChap]
 
==== Patched ====
'''Yes''' in PS4 7.50 FW and in PS5 5.00 or 5.02 FW. Not working in PS5 FWs <= 2.50.
----
 
=== FW <= 5.07 - BPF Race Condition (Yielding Double Free()) ===
 
==== Analysis ====
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%205.05%20BPF%20Double%20Free%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 5.05 BPF Race Condition]
 
==== Bug Description ====
Due to improper locking, two threads can enter the BPF SETWF ioctl command handler. While the bug is similar to that of 4.55, the method of attack is slightly different. Since write() was removed for BPF in 4.70, instead of triggering a use-after-free with write() - SETWF is ran in parallel via threading. Eventually, both calls will copy the same pointer to the stack, leading to both threads free()'ing the same pointer, poisoning the freelist. This can later be leveraged via heap spraying to corrupt heap memory to obtain arbitrary code execution in supervisor mode (ring0).
 
==== Exploit Implementation ====
* [http://crack.bargains/505k/ PS4 5.05 WebKit + Kernel Exploit]
* [https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit PS4 5.05 WebKit + Kernel Exploit Source]
 
==== Patched ====
'''Yes''' in 5.50 FW
----
 
=== FW <= 4.55 - BPF Race Condition (Yielding UaF) ===
 
==== Analysis ====
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 4.55 BPF Race Condition]
 
==== Bug Description ====
Due to improper locking, two threads can enter the BPF ioctl command handlers for setting a new write filter (SETWF) and setting a filter (SETIF). Both threads will reference the same pointer. In specially crafted situations, one thread could free() this pointer while the other thread executes it as a filter post-validation. This allows an unprivileged user to obtain an out-of-bounds (OOB) write on the stack, leading to arbitrary code execution in supervisor mode (ring0).
 
==== Exploit Implementation ====
[http://crack.bargains/455/ PS4 4.55 WebKit + Kernel Exploit]<br/>
[https://github.com/Cryptogenic/PS4-4.55-Kernel-Exploit PS4 4.55 WebKit + Kernel Exploit Source]
 
==== Patched ====
'''Yes''' in 4.70 FW
----
 
=== FW <= 6.00 ?6.02? - sys_getcontext Information Leak (kASLR defeat) (CVE-2018-17155) ===
 
==== Analysis ====
* https://www.cvedetails.com/cve/CVE-2018-17155/
* coming soon by CelesteBlue
 
==== Bug Description ====
System call 421 or sys_getcontext() initializes the structure pointed at by ucp to the currently active context. The vulnerability is, some areas of memory copied out are not initialized, and thus the function leaks memory at certain spots. This vector was patched in 6.20, as now before the buffer is used it is initialized to 0 via bzero().
 
==== Exploit Implementation ====
* QuickHEN by CelesteBlue (v2 not released yet)
* KitHEN by CelesteBlue (not released yet)
 
==== Patched ====
'''Yes''' somewhere between 6.00 and 6.20 FW
----
 
=== FW <= 4.07 - sys_thr_get_ucontext Information Leak (kASLR defeat) ===
 
==== Analysis ====
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md#vector-sys_thr_get_ucontext Specter's Writeup]
 
==== Bug Description ====
System call 634 or sys_thr_get_ucontext() allows to obtain information on a given thread. The vulnerability is, some areas of memory copied out are not initialized, and thus the function leaks memory at certain spots. This vector was patched in 4.50, as now before the buffer is used it is initialized to 0 via bzero().
 
==== Exploit Implementation ====
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]
 
==== Patched ====
'''Yes''' in 4.50 FW
----
 
=== FW <= 4.05 - NamedObj Type Confusion (Yielding UaF) ===
 
==== Credits ====
* Chaitlin Tech for having been the first to show they had pwned PS4 FW 4.01 at Geekpwn convention. (2016-10-24)
[https://www.youtube.com/watch?v=KLkKql31d44 official video], [https://twitter.com/ChaitinTech/status/790945929624948736 tweet 1], [https://twitter.com/ChaitinTech/status/790947840495267841 tweet 2], [https://twitter.com/ChaitinTech/status/790949072429428737 tweet 3] (2016-10-25)
[https://www.youtube.com/watch?v=KLkKql31d44 official video], [https://twitter.com/ChaitinTech/status/790945929624948736 tweet 1], [https://twitter.com/ChaitinTech/status/790947840495267841 tweet 2], [https://twitter.com/ChaitinTech/status/790949072429428737 tweet 3] (2016-10-25)
* fail0verflow for the first writeup (2017-10-19)
* fail0verflow for the first writeup (2017-10-19)
Line 1,460: Line 1,224:


==== Analysis ====
==== Analysis ====
* [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the PS4 1.01-4.05 namedobj kernel exploit] (2017-10-19)
* [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the 1.01-4.05 namedobj kernel exploit] (2017-10-19)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his PS4 4.05 implementation] (2017-12-28)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his 4.05 implementation] (2017-12-28)
* [https://github.com/RPCSX/rpcsx/blob/0bbab3eae53d01afbcdb16e97043b58e26fb54bd/orbis-kernel/src/sys/sys_sce.cpp#L469 Reimplementation of the sys_namedobj_create function in the RPCSX emulator]
* [https://wololo.net/2023/09/04/ps4-ps5-reverse-engineering-101-the-basics-of-ps4-exploits/ Short analysis by wololo (2023-09-04)]


==== Bug Description ====
==== Bug Description ====
Line 1,470: Line 1,232:


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]


==== Patched ====
==== Patched ====
Line 1,479: Line 1,241:
----
----


=== FW <= ?4.05? - amd64_set_ldt Heap Overflow (CVE-2016-1885) ===
=== <= 2.50 - .dynstr/.dynsym kernel table of symbols kept on low FWs ===
 
==== Credits ====
* 2016-10-25 This vulnerability was discovered and researched by Francisco Falcon from Core Exploit Writers Team
* 2016-10-25 Revised patch to address a problem pointed out by ahaha from Chaitin Tech.
 
==== Analysis ====
* https://www.freebsd.org/security/advisories/FreeBSD-SA-16:15.sysarch.asc
* https://www.coresecurity.com/core-labs/advisories/freebsd-kernel-amd64setldt-heap-overflow
* https://web.archive.org/web/20161028222346/https://www.securityfocus.com/archive/1/archive/1/537812/100/0/threaded
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1885
* https://www.mail-archive.com/[email protected]/msg132464.html
* https://svnweb.freebsd.org/base?view=revision&revision=296956
* https://wololo.net/2016/10/26/details-surface-ps4-4-01-jailbreak-potentially-enough-public-release-soon
 
==== Bug Description ====
The IA-32 architecture allows programs to define segments, which provides based and size-limited view into the program address space. The memory-resident processor structure, called Local Descriptor Table, usually abbreviated LDT, contains definitions of the segments. Since incorrect or malicious segments would breach system integrity, operating
systems do not provide processes direct access to the LDT, instead they provide system calls which allow controlled installation and removal of segments.
 
A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode.
 
sysarch is syscall #165 on FreeBSD 9.1 and on PS4. Sony removed set_ldt between System Software version 1.76 and 4.05, according to Red-EyeX32.
 
==== Exploit Implementation ====
 
==== Patched ====
'''Yes''' in some FW <= 4.05 and >= 2.00 as set_ldt was removed. The PS4 is maybe not vulnerable because of a possible lack of 32bit implementation for syscalls.
 
==== Tested ====
Not yet.
----
 
=== <= 3.15 - .symtab kernel table of symbols kept on low FWs ===
 
==== Credits ====
* CelesteBlue for backporting kernel exploits to dump PS4 3.50 kernel (2019-05-09) and 3.15 (2019-05-25)
* zecoxao and SocraticBliss for analysing kernel dumps


==== Bug description ====
==== Bug description ====
After Sony removed .strtab since FW 1.03 and .dynstr/.dynsym since FW 2.50 from PS4 kernel binary, they still kept the .symtab one.


==== Patched ====
* After Sony removed .strtab/.symtab from PS4 kernel binary, they still kept the .dynstr/.dynsym one.
'''Yes''' in 3.50 FW.
----
 
=== <= 2.50 - .dynstr/.dynsym kernel table of symbols kept on low FWs ===
 
==== Bug description ====
After Sony removed .strtab from PS4 kernel binary since FW 1.03, they still kept the .dynstr/.dynsym one.


==== Patched ====
==== Patched ====
Line 1,775: Line 1,493:


'''Yes''' around PS4 FW 1.70.
'''Yes''' around PS4 FW 1.70.
== Secure Kernel ==
=== <=?3.70? - Kernel ASLR collision leads to decrypted kernel partial leak - Matroska vulnerability ===
==== Credits ====
* anonymous for sharing decrypted PS4 6.00b1 kernel file (2019-03-20)
* shykelit for dumping 3.55 Jig PS4 kernel (2019-04-17)
* zecoxao for discovering Matroska kernels and giving them that name (2019-04-18)
* z80 for dumping 3.70 PS4 DevKit kernel (2019-04-18)
* AlexAltea for reverse engineering kernel, ubios and vbios
* Many people for sharing dumps of their PS4 kernels
* CelesteBlue for backporting kernel exploits to dump PS4 4.74 kernel (2018-11-18), 3.50 (2019-05-09), 3.70 (2019-05-15) and 3.15 (2019-05-25)
==== Bug description ====
The kernel memory contains the kernel fSELF but with decrypted data, which in turn can be decompressed to grab ubios, vbios, kernel boot code and partial kernel.
By dumping PS4 kernel memory with a kernel exploit, in order to dump the x86 kernel, we sometimes find a strange fSELF. This fSELF is only partial: 1.5MB, but should be 17MB if it was the x86 kernel. Luckily it is only compressed, not encrypted. When uncompressing it using offzip, we can see only 1 segment. That is because the other segments have been cutted and the segment is incomplete. But we can see that it is the decrypted x86 kernel, as confirmed by diffing with anonymously shared decrypted full x86 kernel. In the decrypted x86 kernel, you can see a second ELF header. It is once again only compressed and not encrypted, and this is what zecoxao named the "Matroska kernel".
Sadly, this vulnerability is random, as it relies on kernel ASLR which is itself random. So depending on the System Software version, as modules have different sizes, kernel ASLR has more (100% on 3.15, 3.50 and 3.70) or less (1% on ?4.74?) chances to leak the Matroska kernel. It is unknown how we could improve this success rate. Maybe by instead of rebooting, causing a kernel panic or rebooting to recovery, entering rest mode then disconnecting power supply. A way to accelerate the process would be to scan kernel memory and check magics to see if there is a Matroska kernel. If there is, dump it, else reboot and cross fingers.
Note: vbios seems to be the same from 3.50 to 6.00b1 at least.
==== Analysis ====
Since PS4 3.50 FW, ASLR (Address Space Layout Randomization) has been enabled in PS4 kernel.
During PS4 boot, the following operations are executed:
* the encrypted x86 kernel is loaded from [[Serial Flash]]
* the secure kernel decrypt the x86 kernel SELF, without uncompressing it to some fixed address: at 0xFFFFFFFF84000000 in the case of 3.xx and 5.xx firmwares or 0xFFFFFFFFC4000000 in the case of 4.xx.
* the secure kernel randomly chooses a base address for Kernel ASLR, starting from 0xFFFFFFFF80000000.
* the secure kernel uncompresses the x86 kernel to the address determined by Kernel ASLR.
On some PS4 boots, Kernel ASLR base address can be very near of Matroska kernel address and the lack of memory separation and wipe renders the dump of Matroska kernel possible with only kernel memory read access.
==== Patched ====
'''Yes''' partially in 4.00 FW by increasing the kernel ASLR base address but it might have reappeared in newer versions like since 5.00 or 4.74, but with lower success rate.
It was also not present on 1.76 and below, so probably appeared when Sony worked on adding ASLR in PS4 Kernel. Also note that Matroska kernel is present on 3.15 even though there is no Kernel ASLR in this version.


== Hardware Exploits ==
== Hardware Exploits ==
Line 1,844: Line 1,524:
* [https://recon.cx/2018/brussels/resources/slides/RECON-BRX-2018-Mess-with-the-best-die-like-the-rest_(mode).pdf Slides of REcon Brussels 2018 by Volodymyr Pikhur]
* [https://recon.cx/2018/brussels/resources/slides/RECON-BRX-2018-Mess-with-the-best-die-like-the-rest_(mode).pdf Slides of REcon Brussels 2018 by Volodymyr Pikhur]
* [https://www.psxhax.com/threads/ps4-southbridge-reverse-engineered-code-examination-by-jogolden.6736/ jogolden's writeup]
* [https://www.psxhax.com/threads/ps4-southbridge-reverse-engineered-code-examination-by-jogolden.6736/ jogolden's writeup]
=== Arbitrary code execution in AMD SMU by incomplete hashing and bounds checking ===
==== Credits ====
* Rudolf Marek discovered, disclosed to AMD then publicly through the following timeline:
** Christmas 2013 - SMU firmware was analyzed from public AMD documentation
** April 2014 - Bug was found in the SMU firmware
** 2014-04-30 - Request to AMD sent
** 2014-05-15 - Reply by AMD
** 2014-05-16 - Encrypted communication, sending details
** 2014-07-09 - AMD acknowledges the problem
** In the meanwhile - Occasional communication
** 2014-11-25 - AMD sends to Rudolf Marek a list of AMD AGESA versions which contain a fix
==== Bug description ====
A security vulnerability, discovered by Rudolf Marek in April 2014, in the recent AMD processors (Trinity and Richland, of FM2 socket) allows arbitrary code execution on the AMD System Management Unit (SMU).
It consists in two bugs in the SMU of AMD Trinity and Richland CPUs:
* The AMD SMU firmware is not padded so some part (256 bytes) of the runtime firmware is not correctly covered by protection cover (0x55 0xaa ...).
* The AMD SMU request function incorrectly checks bounds.
Similar, but not same problem affected AMD Kabini and Kaveri CPUs. It also likely affects PS4 as its [[APU]] is AMD Kabini/Jaguar.
Thanks to this vulnerability, the AMD SMU firmware can be dumped. From the dump, the [[Keys#AMD_SMU_Keys HMAC-SHA1 key]] was obtained.
Thanks to the knowledge of this key, the AMD SMU firmware could possibly be replaced by a custom one.
==== Analysis ====
* [https://fahrplan.events.ccc.de/congress/2014/Fahrplan/system/attachments/2503/original/ccc-final.pdf Slides about exploitation AMD SMU firmware exploitation at 31C3 by Rudolf Marek (2014-12-27)]
* [https://media.ccc.de/v/31c3_-_6103_-_en_-_saal_2_-_201412272145_-_amd_x86_smu_firmware_analysis_-_rudolf_marek Video of Rudolf Marek explaining AMD SMU firmware exploitation at 31C3 (2014-12-27)] or [https://www.youtube.com/watch?v=iYvhHey_dTk mirror]
==== Patched ====
Maybe after 2014-11-25, SMU vulnerability found by Rudolf Marek could have been patched on PS4 as AMD released patches: the fixed SMU firmware is part of updated AMD AGESA.
=== Untested - Arbitrary code execution in AMD SMU by custom firmware ===
==== Credits ====
* Rudolf Marek for his exploit and documentation (2014)
* zecoxao for public disclose (2023-05-17)
==== Bug description ====
It turns out that the "debug key" used to hash "debug" firmwares from AMD SMU effectively works on all retail (CEX) versions of the PS4 AMD SMU firmware as well.
According to zecoxao, as SMU is very privileged in PS4 (but not so privileged in PS5), one could probably dump his own PS4 keys/fuses with AMD SMU code execution. This could possibly lead to decryption of latest PS4 games, SEN access on PS4 running out-of-date System Software, conversion of any PS4 between CEX and DEX, as well as decrypting the PS4 Kernel and derived binaries.
==== Analysis ====
* [https://wololo.net/2023/05/18/ps4-reverse-engineering-progress-on-smu-system-management-unit-could-help-with-hacks/ Article by wololo (2023-05-18)]
==== Patched ====
Maybe on recent PS4 firmwares with a BIOS update that would require a different and possibly more secure digest or signature.




Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/Vulnerabilities"