Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 287: Line 287:
=== WebKit sources ===
=== WebKit sources ===


[https://doc.dl.playstation.net/doc/ps4-oss/webkit.html WebKit sources]
[https://web.archive.org/web/20231108165430/https://doc.dl.playstation.net/doc/ps4-oss/webkit.html WebKit sources] Currently archived up to version 10.01. Useful for developers that can't access PlayStation URLs and also for when Sony inevitably stops hosting the sources in the future.
 
[https://web.archive.org/web/20241007081407/https://doc.dl.playstation.net/doc/ps4-oss/webkit.html WebKit sources] archived currently up to version 11.00. Useful for people that cannot access PlayStation URLs and also for when Sony will inevitably stop hosting the sources.
 
=== FW ?6.00-11.52? - get_by_id_with_this associated with ProxyObject can leak JSScope objects ===
 
==== Credits ====
* Alexey Shvayka for discovery (2021-05-05) and incremental fixes (from 2021-05-20 to 2024-07-31)
* Filip Pizlo for reviewing and not pushing it (2021-06-10)
* Ahmad Saleem for reminding WebKit that it is still not fixed (2022-09-03)
* Yusuke Suzuki and Justin Michaud for fix commits review.
 
==== Analysis ====
* [https://github.com/WebKit/WebKit/pull/35527 Fix commit #3 by Alexey Shvayka (2024-10-21)]
* [https://github.com/WebKit/WebKit/pull/31572 Fix commit #2 by Alexey Shvayka (2024-07-31)]
* [https://github.com/WebKit/WebKit/commit/ceb7e89febcd92b46d65396ce68e0d58ae6bcd6e Fix commit #1 for ProxyObject by Alexey Shvayka (2024-03-14)]
* [https://github.com/WebKit/WebKit/blob/6bb75cf119f4cf3c077ec234af476fb575b28509/Source/WebCore/bindings/js/JSDOMOperation.h#L38 Workaround leftover by Alexey Shvayka (2021-05-20)]
* [https://github.com/WebKit/WebKit/commit/6bb75cf119f4cf3c077ec234af476fb575b28509 Incremental fix commit by Alexey Shvayka (2021-05-20)]
* [https://bugs.webkit.org/show_bug.cgi?id=225397 Bug report on WebKit Bugzilla by Alexey Shvayka (2021-05-05)]
 
==== Bug Description ====
* TODO: document the general vulnerability coming from |this|.
 
According to the spec [1], `var base = { foo }; with (base) foo();` should be called with `this`
value of `base`, which is why FunctionCallResolveNode moves resolved scope to thisRegister().
That is arguably a bad design, and there is an effort [2] to abolish using JSScope as `this` value.
 
When `this` value is accessed by JS code, it's being sanitized via ToThis (JSScope replaced with
`undefined`), yet not in case of `super.property` access calling into ProxyObject `get` trap,
which passes raw `this` value as receiver parameter, leaking JSScope to be exploited.
 
==== Exploit Implementation ====
* [https://github.com/shvaikalesh/WebKit/blob/ee167b8fe4fd234a33b2381640cba982fa6c7516/JSTests/stress/evaluate-with-scope-extension.js Stress code by Alexey Shvayka (2024-10-21)]
* [https://github.com/WebKit/WebKit/blob/ceb7e89febcd92b46d65396ce68e0d58ae6bcd6e/JSTests/stress/regress-120777816.js Regression test by Alexey Shvayka (2024-03-14)]
 
==== Patched ====
'''Maybe'''
 
==== Tested ====
Not tested yet on PS4 or PS5.
----
 
=== FW ?10.00-11.52? - Immediate overflow/underflow in JSC SBFX (CVE-2024-27833) leading to arbitrary code execution ===
 
==== Credits ====
* Manfred Paul (@_manfp), working with Trend Micro Zero Day Initiative, for discovering the vulnerability on Apple Safari at pwn2own 2024 (2024-03-21) [https://twitter.com/thezdi/status/1770611705510293546 Zero Day Initiative's tweet]
* Justin Michaud for fix commit, Yusuke Suzuki for fix commit review (2024-05-15)
* Apple disclose that Safari update integrates the fix (2024-06-10)
* xvonfers and Bearseater (@JamesMa52390215) for discovering it affects PS4 and PS5 (2024-06-11) [https://twitter.com/xvonfers/status/1800426437486485635 xvonfer's tweet]
 
==== Analysis ====
* [https://github.com/WebKit/WebKit/commit/1ea4ef8127276fd00ca43ffcb22bed162072abde WebKit fix commit by Justin Michaud (2024-05-15)]
* [https://bugs.webkit.org/show_bug.cgi?id=271491 WebKit Bugzilla #271491 with restricted access]
 
==== Bug Description ====
There is an integer underflow in WebKit renderer. It was addressed with improved input validation.
 
The JavaScriptCore Isel SBFX patterns in JavaScriptCore/b3/B3LowerToAir.cpp allowed immediate overflow as 'lsb' and 'width' are not properly checked.
 
SBFX stands for Signed Bitfield Extract. See [https://www.scs.stanford.edu/~zyedidia/arm64/sbfx_sbfm.html] and [https://developer.arm.com/documentation/101273/0001/The-Cortex-M55-Instruction-Set--Reference-Material/Bit-field-instructions/SBFX-and-UBFX]. SBFX is an alias for SBFM (Signed Bitfield Move). See [https://www.scs.stanford.edu/~zyedidia/arm64/sbfm.html]. SBFM is a bitfield extraction opcode.
 
Isel is a short name for Instruction SELect. This pass transforms generic machine instructions into equivalent target-specific instructions. It traverses the MachineFunction bottom-up, selecting uses before definitions, enabling trivial dead code elimination.
 
==== Exploit Implementation ====
* [https://github.com/WebKit/WebKit/blob/main/JSTests/stress/sbfx-offset-overflow.js Vulnerability test by Justin Michaud]
 
==== Patched ====
'''Yes''' on PS4 FW 12.00 and PS5 FW ?10.00?.
 
==== Tested ====
Tested working on PS4 FWs 11.50 and PS5 FWs ?6.00-9.60?. Not working on PS4 <= 9.00 and PS5 >= 10.01.
----


=== FW ?10.00?-11.52 - Unknown heap and string overflow (no CVE) leading to crash ===
=== FW ?10.00?-11.52 - Unknown heap and string overflow (no CVE) leading to crash ===
Line 380: Line 309:
'''Yes''' on PS4 FW 12.00 and PS5 FW 10.00.
'''Yes''' on PS4 FW 12.00 and PS5 FW 10.00.


==== Tested ====
Tested working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.
Tested working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.
----
=== FW ?6.00-11.52? - Integer underflow in JSC genericTypedArrayViewProtoFuncCopyWithin (CVE-2023-38600) ===
==== Credits ====
* anonymous researcher for discovering the vulnerability and reporting it to Zero Day Initiative (2023-05)
* Yusuke Suzuki and Mark Lam for fixing the bug in WebKit (2023-07-31)
* Hossein Lotfi for publishing a writeup (2023-10-18)
==== Analysis ====
* [https://www.zerodayinitiative.com/blog/2023/10/17/cve-2023-38600-story-of-an-innocent-apple-safari-copywithin-gone-way-outside Writeup by Hossein Lotfi (2023-10-18)]
* [https://github.com/WebKit/WebKit/commit/6e7e654417b61630d67f02b65798439cf3d6b0b5 WebKit fix commit by Yusuke Suzuki (2023-07-31)]
==== Bug Description ====
It is required to recompute length properly when resize happens during TypedArray copyWithin.
copyWithin's side effectful operation can resize resizable ArrayBuffer. WebKit has a code catching this and recompute the appropriate copy count again, but it can overflow if `to` or `from` are larger than the newly updated `length`. The patch handles this case correctly: returning since there is no copying content in this case.
The issue was patched by aborting the copy if either of the two variables to or from is larger than the updated length.
The values used during the exploit were sane as they went through a sanitizer function. However, in the final stage, the values were updated without checking if there are inside the buffer length bounds.
According to PS4 WebKit source code for System Software version 11.00, not only it is not patched but it uses code from 2021! Looking at [https://github.com/WebKit/WebKit/blob/cccb58deac3c56a831678458ce95ea5b7c837614/Source/JavaScriptCore/runtime/JSGenericTypedArrayViewPrototypeFunctions.h#L177 a version close to one in the PS4 source code for System Software version 11.00], it should be exploitable.
==== Exploit Implementation ====
* [https://gist.github.com/zdi-team/ad320bdc6ad095cc210c7031e0f0ecda/raw/746ce622fe73344ccb9cd51bc03ad97950f4ea3b/CVE-2023-38600-0.js Minimal PoC by Hossein Lotfi (2023-10-18)]
* [https://github.com/WebKit/WebKit/blob/main/JSTests/stress/resizable-array-buffer-copy-within-length-update.js Vulnerability test code by Yusuke Suzuki (2023-07-31)]
==== Patched ====
'''Maybe''' in FW 11.50.
==== Tested ====
Not tested yet on PS4 nor PS5. To test on PS4 11.00.
----
=== FW ?10.00-11.02? - JSC::DFG::clobberize() needs to be more precise with the *ByOffset nodes (CVE-2023-41993) leading to arbitrary RW ===
==== Credits ====
* Bill Marczak of The Citizen Lab at The University of Toronto's Munk School and Maddie Stone of Google's Threat Analysis Group for discoverting the vulnerability and reporting it (2023-09-21)
* Keith Miller for the WebKit fix commit (2023-10-09)
* po6ix for his writeup (2023-10-15)
==== Analysis ====
* [https://github.com/WebKit/WebKit/commit/08d5d17c766ffc7ca6a7c833c5720eb71b427784 WebKit fix commit by Keith Miller (2023-10-09)]
* [https://github.com/po6ix/POC-for-CVE-2023-41993 Writeup by po6ix (2023-10-15)]
==== Bug Description ====
clobberize needs to be more precise with the *ByOffset nodes. CSE phase uses clobberize to figure out if it's safe to merge two operations that def the same HeapLocation. Since HeapLocation does not currently have a way to track the offset used by the various *ByOffset nodes it can get confused and think that two ByOffset instructions produce the same value even if they do not use the same offset. This patch solves this by adding a new field to HeapLocation, which takes the metadata associated with the corresponding *ByOffset node. If two *ByOffset operations don't share the same metadata then they cannot be CSEed.
This vulnerability is ranked 7.5 (HIGH) on CVSS:3.1.
This vulnerability should provide r/w primitive to the webcontent process, but currently the PoC is written only up to addrof/fakeobj.
==== Exploit Implementation ====
* [https://github.com/po6ix/POC-for-CVE-2023-41993 PoC written only up to addrof/fakeobj by po6ix (2023-10-15)]
==== Patched ====
'''Maybe''' on PS4 FW 12.00 and PS5 ?10.00?
==== Tested ====
Not tested yet. According to open source code, PS4 FW 11.00 should be vulnerable.
----


=== FW 10.00-11.02 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to crash ===
=== FW 10.00-11.02 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to crash ===


==== Credits ====
==== Credits ====
* Alexey Shvayka for vulnerability discovery and fixes in WebKit (2023-05-01)
* ENKI for public disclose and analysis (2024-06-03)
* ENKI for public disclose and writeup (2024-06-03)
* abc (anonymous) for tests and analysis (2024-10-01)


==== Analysis ====
==== Analysis ====
* [https://medium.com/@enki-techblog/ios-16-5-1-safari-rce-analysis-cve-2023-37450-89bb8583bebc Analysis by ENKI (2024-06-03)]
* [https://medium.com/@enki-techblog/ios-16-5-1-safari-rce-analysis-cve-2023-37450-89bb8583bebc Analysis by ENKI (2024-06-03)]
* [https://github.com/WebKit/WebKit/commit/1b0741f400ee2d31931ae30f2ddebe66e8fb0945 Patch commit #1 for vulnerability detection (2023-07-31)]
* [https://github.com/WebKit/WebKit/commit/1b0741f400ee2d31931ae30f2ddebe66e8fb0945 Patch commit #1 (2023-07-31)]
* [https://github.com/WebKit/WebKit/commit/39476b8c83f0ac6c9a06582e4d8e5aef0bb0a88f Patch commit #2 (2023-05-01)]
* [https://github.com/WebKit/WebKit/commit/39476b8c83f0ac6c9a06582e4d8e5aef0bb0a88f Patch commit #2 (2023-05-01)]
* [https://www.zerodayinitiative.com/blog/2018/4/12/inverting-your-assumptions-a-guide-to-jit-comparisons Inverting Your Assumptions: A Guide to JIT Comparisons by Jasiel Spelman (2018-04-12)]
* [https://www.zerodayinitiative.com/blog/2018/4/12/inverting-your-assumptions-a-guide-to-jit-comparisons Inverting Your Assumptions: A Guide to JIT Comparisons by Jasiel Spelman (2018-04-12)]


==== Bug Description ====
==== Bug Description ====
Note that the PS4 web browser JIT support has been removed since around PS4 System Software version 5.00 or lower so using the article directly is not applicable.
According to abc (anonymous):
 
"The clobber bug PoC turns out not to be a memory corruption. Just like the article said, you can access a `GetterSetter` directly. The crash came from triggering `GetterSetter`'s methods that will call `RELEASE_ASSERT()`. We actually came across a bug that can leak `GetterSetter`s at WebKit's git main branch: `ceb7e89febcd [JSC] get_by_id_with_this + ProxyObject can leak JSScope objects https://bugs.webkit.org/show_bug.cgi?id=267425 <rdar://120777816>`
The clobber bug PoC turns out not to be a memory corruption. Just like the article said, you can access a `GetterSetter` directly. The crash came from triggering `GetterSetter`'s methods that will call `RELEASE_ASSERT()`.
<br />
 
In summary with tinkering with this bug, we do not think you can do anything useful with accessing a `GetterSetter`. The clobber bug however does allow setting properties in places where you usually cannot like `Function's prototype` in the article. But without JIT, we do not think you can cause any memory corruption. The impact for both bugs is probably just JS execution, which we already have, which is a no go in some context (JS injection) but it does not help in gaining PS4/PS5 usermode execution.
We actually have [[#FW_?6.00-11.52?_-_get_by_id_with_this_associated_with_ProxyObject_can_leak_JSScope_objects|a bug that can leak `GetterSetter`s]].
<br />
 
Note that the PS4 webbrowser JIT has been removed around PS4 System Software version 5.00 or lower so using the article is not applicable."
In summary with tinkering with this bug, abc (anonymous) do not think that an attacker can do anything useful with accessing a `GetterSetter`. The clobberWorld bug however does allow setting properties in places where you usually cannot like `Function's prototype` as shown in the article. But without JIT, one probably cannot cause any memory corruption. The impact for both bugs (clobberWorld and ProxyObject) is probably just JavaScript execution, which we already have, which is a no go in some context (JS injection) but it does not help in gaining usermode ROP execution on PS4 or PS5.


==== Exploit Implementation ====
==== Exploit Implementation ====
Line 473: Line 336:
'''Yes''' on PS4 FW 11.50 and PS5 FW 9.00.
'''Yes''' on PS4 FW 11.50 and PS5 FW 9.00.


==== Tested ====
Tested working on PS4 FWs 10.00-11.02 and PS5 FWs 6.00-8.60. PS4 FWs <= ?9.60? and PS5 FWs <= ?5.50? are invulnerable.
Tested working on PS4 FWs 10.00-11.02 and PS5 FWs 6.00-8.60. PS4 FWs <= ?9.60? and PS5 FWs <= ?5.50? are invulnerable.
----


=== FW 6.00-9.60 - FrameLoader::loadInSameDocument() UaF (CVE-2022-22620) leading to arbitrary RW ===
=== FW 6.00-9.60 - FrameLoader::loadInSameDocument() UaF (CVE-2022-22620) leading to arbitrary RW ===
Line 482: Line 343:
* Sergei Glazunov, Google Project Zero, for reporting the bug in 2013-01 and answering Maddie Stone's questions in 2022 (2013)
* Sergei Glazunov, Google Project Zero, for reporting the bug in 2013-01 and answering Maddie Stone's questions in 2022 (2013)
* Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2022-06-14)
* Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2022-06-14)
* abc (anonymous) for making an OOM PoC for webkit-gtk, PS4 and PS5 (2023-10-03) then making an arbitrary RW PoC (PSFree) for webkit-gtk, PS4 6.00-9.60 and PS5 1.00-5.50 (2023-10-24)
* Abc (anonymous person) for making an OOM PoC for webkit-gtk, PS4 and PS5 (2023-10-03) then making an arbitrary RW PoC (PSFree) for webkit-gtk, PS4 6.00-9.60 and PS5 1.00-5.50 (2023-10-24)
* CelesteBlue for testing and porting abc' PSFree to PS4 6.00-9.60 and PS5 1.00-5.50 (2023-11-04)
* CelesteBlue for testing and porting abc' PSFree to PS4 6.00-9.60 and PS5 1.00-5.50 (2023-11-04)


Line 545: Line 406:
The patch changes the stateObject argument to loadInSameDocument from a raw pointer, SerializedScriptValue*, to a reference-counted pointer, RefPtr<SerializedScriptValue>, so that loadInSameDocument now increments the reference count on the object.
The patch changes the stateObject argument to loadInSameDocument from a raw pointer, SerializedScriptValue*, to a reference-counted pointer, RefPtr<SerializedScriptValue>, so that loadInSameDocument now increments the reference count on the object.


==== Tested ====
Tested working on PS4 FWs 6.00-9.60 and PS5 FWs 1.00-5.50. PS4 FWs <= 5.56 are invulnerable as the HTML input field stays focused (blue outline) after second timeout whilst it should not if the console were exploitable.
Tested working on PS4 FWs 6.00-9.60 and PS5 FWs 1.00-5.50. PS4 FWs <= 5.56 are invulnerable as the HTML input field stays focused (blue outline) after second timeout whilst it should not if the console were exploitable.
----


=== FW 9.00-9.04 - WebCore::CSSFontFaceSet vulnerabilities leading to arbitrary RW ===
=== FW 9.00-9.04 - WebCore::CSSFontFaceSet vulnerabilities leading to arbitrary RW ===
Line 596: Line 455:
Might have been introduced in PS4 FW 3.50 and before PS5 FW 1.00 according to dates (need to check). However the vulnerability cannot be exploited in some conditions depending on how WebKit was compiled. For example, on PS4 FWs 7.55-8.52 and PS5 FWs <= 2.00, the FontFaceSet constructor returns with an exception that is propagated to JavaScript, preventing exploitation this way.
Might have been introduced in PS4 FW 3.50 and before PS5 FW 1.00 according to dates (need to check). However the vulnerability cannot be exploited in some conditions depending on how WebKit was compiled. For example, on PS4 FWs 7.55-8.52 and PS5 FWs <= 2.00, the FontFaceSet constructor returns with an exception that is propagated to JavaScript, preventing exploitation this way.


==== Tested ====
Tested working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00.
Tested working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00.
----


=== FW 6.00-7.55 - WebCore::ValidationMessage::buildBubbleTree() UaF leading to arbitrary RW ===
=== FW 6.00-7.55 - WebCore::ValidationMessage::buildBubbleTree() UaF leading to arbitrary RW ===
Line 626: Line 483:


==== Patched ====
==== Patched ====
'''Yes''' in 8.00 FW.
'''Yes''' in 8.00 FW. Tested working on FWs 6.00-7.55, not working on FWs <= 5.56. HTML textarea guessed addresses for FWs 6.70-7.55 are known but not for FWs 6.00-6.51 so an attacker needs to make tests to determine these addresses on FWs 6.00-6.51.
 
==== Tested ====
Tested working on FWs 6.00-7.55, not working on FWs <= 5.56. HTML textarea guessed addresses for FWs 6.70-7.55 are known but not for FWs 6.00-6.51 so an attacker needs to make tests to determine these addresses on FWs 6.00-6.51.
----


=== FW 6.00-6.72 - bad_hoist Type Confusion exploit (CVE-2018-4386) leading to arbirary RW ===
=== FW 6.00-6.72 - bad_hoist Type Confusion exploit (CVE-2018-4386) leading to arbirary RW ===
Line 673: Line 526:


==== Patched ====
==== Patched ====
'''Yes''' in 7.00 FW.
'''Yes''' in 7.00 FW. Vulnerable on PS4 FWs 4.50-6.72. Not vulnerable on FWs <= 4.07. Not vulnerable on FWs >=7.00 according to manual tests but need to check WebKit sources.
 
==== Tested ====
Vulnerable on PS4 FWs 4.50-6.72. Not vulnerable on FWs <= 4.07. Not vulnerable on FWs >=7.00 according to manual tests but need to check WebKit sources.
----
----


Line 699: Line 549:


==== Patched ====
==== Patched ====
'''Yes''' in 6.50 FW.
'''Yes''' in 6.50 FW. It does not work on <= 4.07 FW PS4 according to tests as the exploit fails at step "Triggering memory corruption".
 
==== Tested ====
It does not work on <= 4.07 FW PS4 according to tests as the exploit fails at step "Triggering memory corruption".
----
----


Line 843: Line 690:
==== Tested ====
==== Tested ====
Works on 3.15-4.07. Not working on <= 3.11.
Works on 3.15-4.07. Not working on <= 3.11.
----
=== FW <= ?4.05? - Type confusion in WebCore::HTMLInputElement::onSearch (CVE-2017-2354) ===
==== Credits ====
* Neymar of Tencent's Xuanwu Lab working with Trend Micro's Zero Day Initiative for discovering this vulnerability (2016-11)
* Brent Fulgham for fixing the bug in WebKit (2016-11-14)
* Jasiel Spelman (@WanderingGlitch) for his writeup (2017-12-20)
==== Analysis ====
* [https://www.zerodayinitiative.com/blog/2017/12/20/invariantly-exploitable-input-an-apple-safari-bug-worth-revisiting Writeup by Jasiel Spelman (2017-12-20)]
* [https://github.com/WebKit/WebKit-http/commit/cf2bf6e58f51267d7ae25fcb82a315377c8e5cf6 WebKit fix commit by Brent Fulgham (2016-11-14)]
==== Bug Description ====
It is possible for JavaScript to change the type property of an input field. WebKit needs to gracefully handle this case.
This bug could have been prevented had it a debug check been used instead of a runtime check. In fact, WebKit has support for this type of assertion already through a RELEASE_ASSERT macro, which would have turned this exploitable bug into a simple denial-of-service by immediately and safely crashing the browser.
The fix commit of the vulnerability adds a type traits specialization so that WebKit can properly downcast InputType elements. This should be used only to call search functions on actual search input types.
Although the access violation in WebCore::TimerBase::heapPop is where we see the result of the bug, it is not the cause of the issue. The crash actually occurs as a result of reading a pointer that comes from the 'this' object. Based on that, it would seem that something is wrong with the Timer object passed into the WebCore::TimerBase::heapPop function.
This vulnerability may be the one used by Chaintin Tech with a kernel exploit on PS4 FW 4.01 at GeekPwn 2016, a Tencent Security's conference, in Shanghai Station at the Pavilion Safety Research Lab, (https://www.chaitin.cn/ps4, https://www.psxhax.com/threads/ps4-4-01-linux-installation-ksploit-demo-at-geekpwn-2016.932/)
==== Exploit Implementation ====
* PoC by Neymar (2016-11, disclosed publicly by Jasiel Spelman on 2017-12-20):
<source lang="js">
<input id="m_input" type="search"></input>
<script type="text/javascript">
first = true;
m_input.addEventListener("input", function (e) {
if(first) {
first = false;
}
else {
m_input["type"] = "image";
}
}, false);
</script>
</source>
* [https://github.com/WebKit/WebKit-http/blob/master/LayoutTests/fast/forms/search-cancel-button-change-input.html Vulnerability test by Brent Fulgham (2016-11-15)]
==== Patched ====
'''Maybe''' in 4.06 FW
==== Tested ====
Not yet.
----
----


Line 900: Line 700:


==== Analysis ====
==== Analysis ====
* [https://blog.xyz.is/2016/webkit-360.html PSVita 3.60 HENkaku WebKit exploit writeup]
* [https://blog.xyz.is/2016/webkit-360.html PSVita 3.60 HENKaku WebKit exploit writeup]


==== Bug Description ====
==== Bug Description ====
Line 918: Line 718:


=== FW <= 3.50 - WebCore::TimerBase::heapPopMin() Heap UaF leading to crash ===
=== FW <= 3.50 - WebCore::TimerBase::heapPopMin() Heap UaF leading to crash ===
==== Credits ====
* Brent Fulgham for fixing the bug in WebKit (2016-05-16)


==== Analysis ====
==== Analysis ====
* [https://github.com/WebKit/WebKit-http/commit/98845d940e30529098eea7e496af02e14301c704 WebKit fix commit (2016-05-17)]
* [https://github.com/WebKit/WebKit-http/commit/98845d940e30529098eea7e496af02e14301c704 WebKit fix commit (17-05-2016)]
* [https://xz.aliyun.com/t/292 Summary of Critical and Exploitable iOS Vulnerabilities in 2016 by Min (Spark) Zheng, Cererdlong, Eakerqiu @ Team OverSky]
* [https://xz.aliyun.com/t/292 Summary of Critical and Exploitable iOS Vulnerabilities in 2016 by Min (Spark) Zheng, Cererdlong, Eakerqiu @ Team OverSky]


Line 930: Line 727:


==== Exploit Implementation ====
==== Exploit Implementation ====
* [http://psxhax.com/threads/ps4-3-50-webkit-exploit-from-playstation-4-dev-qwertyoruiop.450/ Article about qwertyoruiop's tests (2016-05-20)]
* [http://psxhax.com/threads/ps4-3-50-webkit-exploit-from-playstation-4-dev-qwertyoruiop.450/ Article about qwertyoruiop's tests (20-05-2016)]
* [http://psxhax.com/threads/ps4-heap-use-after-free-at-webcore-3-50-poc-by-hunter128.452/ Article about initial PoC for PS4 (2016-05-21)]
* [http://psxhax.com/threads/ps4-heap-use-after-free-at-webcore-3-50-poc-by-hunter128.452/ Article about initial PoC for PS4 (21-05-2016)]
* [http://wololo.net/talk/viewtopic.php?t=45888 Initial PoC for PS4 (2016-05-21)]
* [http://wololo.net/talk/viewtopic.php?t=45888 Initial PoC for PS4 (21-05-2016)]
* [https://web.archive.org/web/20161030085033/http://cryptoanarchic.me/wat.txt iOS 9.3.2 WebKit RCE via heapPopMin (2016-07)]
* [https://web.archive.org/web/20161030085033/http://cryptoanarchic.me/wat.txt iOS 9.3.2 WebKit RCE via heapPopMin (07-2016)]
* [https://twitter.com/qwertyoruiopz/status/756268361282125824 qwertyoruiop's tweet (2016-07-22)]
* [https://twitter.com/qwertyoruiopz/status/756268361282125824 qwertyoruiop's tweet (22-07-2016)]
* [https://github.com/Jailbreaks/jbme/tree/master mirror of iOS 9.3.2 WebKit RCE via heapPopMin]
* [https://github.com/Jailbreaks/jbme/tree/master mirror of iOS 9.3.2 WebKit RCE via heapPopMin]


Line 1,043: Line 840:


* Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013)
* Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013)
* nas and Proxima for the first PS4 POC on 1.76 PS4 (October 23, 2014)
* nas and Proxima for the first PS4 POC on 1.76 PS4 (Oct. 23, 2014)
* sony for patching the exploit in FW 2.00 (October 27, 2014)
* sony for patching the exploit in FW 2.00 (Oct 27, 2014)
* CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849]
* CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849]


Line 1,068: Line 865:


==== Tested ====
==== Tested ====
* Working on PS4 1.00-1.76 FW, AppleWebKit/531.3-536.26
* Working on 1.00-1.76 FW, AppleWebKit/531.3-536.26
* Might work on PS4 FW 0.930.020.
* Might work on FW 0.930.020.
 
=== Possible WebKit vulnerabilities ===
 
Affecting WebKitGTK: CVE-2023-41074, CVE-2023-42917.


== Usermode securities ==
== Usermode securities ==
Line 1,177: Line 970:
* [https://www.freebsd.org/security/advisories/FreeBSD-SA-06:18.ppp.asc FreeBSD Security Advisory for CVE-2006-4304 (2006-08-23)]
* [https://www.freebsd.org/security/advisories/FreeBSD-SA-06:18.ppp.asc FreeBSD Security Advisory for CVE-2006-4304 (2006-08-23)]
* [https://hackerone.com/reports/2177925 HackerOne report about Remote vulnerabilities in spp by TheFloW (2023-09-22)]
* [https://hackerone.com/reports/2177925 HackerOne report about Remote vulnerabilities in spp by TheFloW (2023-09-22)]
* [https://romhack.io/wp-content/uploads/sites/3/2024/10/Andy-Nguyen-PlayStation-4-Remote-Kernel-Exploitation-RomHack-2024.pdf Slides of TheFloW's presentation at RomHack 2024 (2024-09-28)]
* [https://www.youtube.com/watch?v=LRdbnGkk7JA Video of TheFloW's presentation at RomHack 2024 (2024-09-28)]


==== Bug Description ====
==== Bug Description ====
Line 1,460: Line 1,251:


==== Analysis ====
==== Analysis ====
* [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the PS4 1.01-4.05 namedobj kernel exploit] (2017-10-19)
* [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the 1.01-4.05 namedobj kernel exploit] (2017-10-19)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his PS4 4.05 implementation] (2017-12-28)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his 4.05 implementation] (2017-12-28)
* [https://github.com/RPCSX/rpcsx/blob/0bbab3eae53d01afbcdb16e97043b58e26fb54bd/orbis-kernel/src/sys/sys_sce.cpp#L469 Reimplementation of the sys_namedobj_create function in the RPCSX emulator]
* [https://wololo.net/2023/09/04/ps4-ps5-reverse-engineering-101-the-basics-of-ps4-exploits/ Short analysis by wololo (2023-09-04)]


==== Bug Description ====
==== Bug Description ====
Line 1,470: Line 1,259:


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]


==== Patched ====
==== Patched ====
Line 1,477: Line 1,266:
==== Tested ====
==== Tested ====
Works on FWs 4.00-4.05. On <= 3.70 FW we have not found a way to leak the target object, but it might be doable as Fail0verflow did it on 1.01.
Works on FWs 4.00-4.05. On <= 3.70 FW we have not found a way to leak the target object, but it might be doable as Fail0verflow did it on 1.01.
----
=== FW <= ?4.05? - amd64_set_ldt Heap Overflow (CVE-2016-1885) ===
==== Credits ====
* 2016-10-25 This vulnerability was discovered and researched by Francisco Falcon from Core Exploit Writers Team
* 2016-10-25 Revised patch to address a problem pointed out by ahaha from Chaitin Tech.
==== Analysis ====
* https://www.freebsd.org/security/advisories/FreeBSD-SA-16:15.sysarch.asc
* https://www.coresecurity.com/core-labs/advisories/freebsd-kernel-amd64setldt-heap-overflow
* https://web.archive.org/web/20161028222346/https://www.securityfocus.com/archive/1/archive/1/537812/100/0/threaded
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1885
* https://www.mail-archive.com/[email protected]/msg132464.html
* https://svnweb.freebsd.org/base?view=revision&revision=296956
* https://wololo.net/2016/10/26/details-surface-ps4-4-01-jailbreak-potentially-enough-public-release-soon
==== Bug Description ====
The IA-32 architecture allows programs to define segments, which provides based and size-limited view into the program address space. The memory-resident processor structure, called Local Descriptor Table, usually abbreviated LDT, contains definitions of the segments. Since incorrect or malicious segments would breach system integrity, operating
systems do not provide processes direct access to the LDT, instead they provide system calls which allow controlled installation and removal of segments.
A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode.
sysarch is syscall #165 on FreeBSD 9.1 and on PS4. Sony removed set_ldt between System Software version 1.76 and 4.05, according to Red-EyeX32.
==== Exploit Implementation ====
==== Patched ====
'''Yes''' in some FW <= 4.05 and >= 2.00 as set_ldt was removed. The PS4 is maybe not vulnerable because of a possible lack of 32bit implementation for syscalls.
==== Tested ====
Not yet.
----
----


Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/Vulnerabilities"