Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 290: Line 290:


[https://web.archive.org/web/20241007081407/https://doc.dl.playstation.net/doc/ps4-oss/webkit.html WebKit sources] archived currently up to version 11.00. Useful for people that cannot access PlayStation URLs and also for when Sony will inevitably stop hosting the sources.
[https://web.archive.org/web/20241007081407/https://doc.dl.playstation.net/doc/ps4-oss/webkit.html WebKit sources] archived currently up to version 11.00. Useful for people that cannot access PlayStation URLs and also for when Sony will inevitably stop hosting the sources.
=== Untested - mmap issue involving pointer address misalignment leading to nothing for now ===
==== Credits ====
* Jasmine, working for Sony, for information through a WebKit commit (2022-10-19)
==== Analysis ====
* https://bugs.webkit.org/show_bug.cgi?id=246763
==== Bug Description ====
There is a mmap issue involving pointer address misalignmen because of a failing assert [https://github.com/WebKit/WebKit/blob/main/Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.cpp#L94 here]. A workaround is to set HAVE_MAP_ALIGNED flag as OFF in OptionsPlayStation.cmake: [https://github.com/WebKit/WebKit/commit/626585db9857b7630cf34d82f9a0555720f15bca]. This workaround can be reverted after the mmap issue is resolved. Currently, the workaround is still enabled: [https://github.com/WebKit/WebKit/blob/ab2fff92b37e52d6c65e215b155e6b92f1646954/Source/cmake/OptionsPlayStation.cmake#L251]
==== Exploit Implementation ====
==== Patched ====
'''Maybe'''
==== Tested ====
Not tested yet on PS4 or PS5.
----


=== FW ?6.00-11.52? - get_by_id_with_this associated with ProxyObject can leak JSScope objects ===
=== FW ?6.00-11.52? - get_by_id_with_this associated with ProxyObject can leak JSScope objects ===
Line 329: Line 349:
----
----


=== FW ?10.00-11.52? - Immediate overflow/underflow in JSC SBFX (CVE-2024-27833) leading to arbitrary code execution ===
=== FW ?10.00-11.52? - Integer underflow in WebKit renderer (CVE-2024-27833) leading to arbitrary code execution ===


==== Credits ====
==== Credits ====
* Manfred Paul (@_manfp), working with Trend Micro Zero Day Initiative, for discovering the vulnerability on Apple Safari at pwn2own 2024 (2024-03-21) [https://twitter.com/thezdi/status/1770611705510293546 Zero Day Initiative's tweet]
* Manfred Paul (@_manfp), working with Trend Micro Zero Day Initiative, for discovering the vulnerability on Apple Safari at pwn2own 2024 (2024-03-21) [https://twitter.com/thezdi/status/1770611705510293546 Zero Day Initiative's tweet]
* Apple Safari update integrates a fix (2024-06-10)
==== Analysis ====
==== Bug Description ====
There is an integer underflow in WebKit renderer. It was addressed with improved input validation.
It is associated with WebKit Bugzilla #271491.
==== Exploit Implementation ====
==== Patched ====
'''Maybe''' on PS4 FW 12.00 and PS5 FW ?10.00?.
==== Tested ====
Not tested as there is no PoC available.
----
=== FW ?10.00-11.52? - Immediate overflow in JSC SBFX leading to crash ===
==== Credits ====
* Justin Michaud for fix commit, Yusuke Suzuki for fix commit review (2024-05-15)
* Justin Michaud for fix commit, Yusuke Suzuki for fix commit review (2024-05-15)
* Apple disclose that Safari update integrates the fix (2024-06-10)
* xvonfers for discovering it affects PS4 and PS5 (2024-06-11) [https://twitter.com/xvonfers/status/1800426437486485635 xvonfer's tweet]
* xvonfers and Bearseater (@JamesMa52390215) for discovering it affects PS4 and PS5 (2024-06-11) [https://twitter.com/xvonfers/status/1800426437486485635 xvonfer's tweet]


==== Analysis ====
==== Analysis ====
* [https://github.com/WebKit/WebKit/commit/1ea4ef8127276fd00ca43ffcb22bed162072abde WebKit fix commit by Justin Michaud (2024-05-15)]
* [https://github.com/WebKit/WebKit/commit/1ea4ef8127276fd00ca43ffcb22bed162072abde WebKit fix commit by Justin Michaud (2024-05-15)]
* [https://bugs.webkit.org/show_bug.cgi?id=271491 WebKit Bugzilla #271491 with restricted access]


==== Bug Description ====
==== Bug Description ====
There is an integer underflow in WebKit renderer. It was addressed with improved input validation.
The JavaScriptCore Isel SBFX patterns in JavaScriptCore/b3/B3LowerToAir.cpp allowed immediate overflow as 'lsb' and 'width' are not properly checked.
The JavaScriptCore Isel SBFX patterns in JavaScriptCore/b3/B3LowerToAir.cpp allowed immediate overflow as 'lsb' and 'width' are not properly checked.


Line 448: Line 485:


==== Credits ====
==== Credits ====
* Alexey Shvayka for vulnerability discovery and fixes in WebKit (2023-05-01)
* ENKI for public disclose and analysis (2024-06-03)
* ENKI for public disclose and writeup (2024-06-03)
* abc (anonymous) for tests and analysis (2024-10-01)
* abc (anonymous) for tests and analysis (2024-10-01)


==== Analysis ====
==== Analysis ====
* [https://medium.com/@enki-techblog/ios-16-5-1-safari-rce-analysis-cve-2023-37450-89bb8583bebc Analysis by ENKI (2024-06-03)]
* [https://medium.com/@enki-techblog/ios-16-5-1-safari-rce-analysis-cve-2023-37450-89bb8583bebc Analysis by ENKI (2024-06-03)]
* [https://github.com/WebKit/WebKit/commit/1b0741f400ee2d31931ae30f2ddebe66e8fb0945 Patch commit #1 for vulnerability detection (2023-07-31)]
* [https://github.com/WebKit/WebKit/commit/1b0741f400ee2d31931ae30f2ddebe66e8fb0945 Patch commit #1 (2023-07-31)]
* [https://github.com/WebKit/WebKit/commit/39476b8c83f0ac6c9a06582e4d8e5aef0bb0a88f Patch commit #2 (2023-05-01)]
* [https://github.com/WebKit/WebKit/commit/39476b8c83f0ac6c9a06582e4d8e5aef0bb0a88f Patch commit #2 (2023-05-01)]
* [https://www.zerodayinitiative.com/blog/2018/4/12/inverting-your-assumptions-a-guide-to-jit-comparisons Inverting Your Assumptions: A Guide to JIT Comparisons by Jasiel Spelman (2018-04-12)]
* [https://www.zerodayinitiative.com/blog/2018/4/12/inverting-your-assumptions-a-guide-to-jit-comparisons Inverting Your Assumptions: A Guide to JIT Comparisons by Jasiel Spelman (2018-04-12)]
Line 463: Line 499:
The clobber bug PoC turns out not to be a memory corruption. Just like the article said, you can access a `GetterSetter` directly. The crash came from triggering `GetterSetter`'s methods that will call `RELEASE_ASSERT()`.
The clobber bug PoC turns out not to be a memory corruption. Just like the article said, you can access a `GetterSetter` directly. The crash came from triggering `GetterSetter`'s methods that will call `RELEASE_ASSERT()`.


We actually have [[#FW_?6.00-11.52?_-_get_by_id_with_this_associated_with_ProxyObject_can_leak_JSScope_objects|a bug that can leak `GetterSetter`s]].
We actually came across a bug that can leak `GetterSetter`s at WebKit's git main branch: `ceb7e89febcd [JSC] get_by_id_with_this + ProxyObject can leak JSScope objects https://bugs.webkit.org/show_bug.cgi?id=267425 <rdar://120777816>`


In summary with tinkering with this bug, abc (anonymous) do not think that an attacker can do anything useful with accessing a `GetterSetter`. The clobberWorld bug however does allow setting properties in places where you usually cannot like `Function's prototype` as shown in the article. But without JIT, one probably cannot cause any memory corruption. The impact for both bugs (clobberWorld and ProxyObject) is probably just JavaScript execution, which we already have, which is a no go in some context (JS injection) but it does not help in gaining usermode ROP execution on PS4 or PS5.
In summary with tinkering with this bug, abc (anonymous) do not think that an attacker can do anything useful with accessing a `GetterSetter`. The clobberWorld bug however does allow setting properties in places where you usually cannot like `Function's prototype` as shown in the article. But without JIT, one probably cannot cause any memory corruption. The impact for both bugs (clobberWorld and ProxyObject) is probably just JavaScript execution, which we already have, which is a no go in some context (JS injection) but it does not help in gaining usermode ROP execution on PS4 or PS5.
Line 1,460: Line 1,496:


==== Analysis ====
==== Analysis ====
* [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the PS4 1.01-4.05 namedobj kernel exploit] (2017-10-19)
* [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the 1.01-4.05 namedobj kernel exploit] (2017-10-19)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his PS4 4.05 implementation] (2017-12-28)
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his 4.05 implementation] (2017-12-28)
* [https://github.com/RPCSX/rpcsx/blob/0bbab3eae53d01afbcdb16e97043b58e26fb54bd/orbis-kernel/src/sys/sys_sce.cpp#L469 Reimplementation of the sys_namedobj_create function in the RPCSX emulator]
* [https://wololo.net/2023/09/04/ps4-ps5-reverse-engineering-101-the-basics-of-ps4-exploits/ Short analysis by wololo (2023-09-04)]


==== Bug Description ====
==== Bug Description ====
Line 1,470: Line 1,504:


==== Exploit Implementation ====
==== Exploit Implementation ====
* [https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit]


==== Patched ====
==== Patched ====
Line 1,477: Line 1,511:
==== Tested ====
==== Tested ====
Works on FWs 4.00-4.05. On <= 3.70 FW we have not found a way to leak the target object, but it might be doable as Fail0verflow did it on 1.01.
Works on FWs 4.00-4.05. On <= 3.70 FW we have not found a way to leak the target object, but it might be doable as Fail0verflow did it on 1.01.
----
=== FW <= ?4.05? - amd64_set_ldt Heap Overflow (CVE-2016-1885) ===
==== Credits ====
* 2016-10-25 This vulnerability was discovered and researched by Francisco Falcon from Core Exploit Writers Team
* 2016-10-25 Revised patch to address a problem pointed out by ahaha from Chaitin Tech.
==== Analysis ====
* https://www.freebsd.org/security/advisories/FreeBSD-SA-16:15.sysarch.asc
* https://www.coresecurity.com/core-labs/advisories/freebsd-kernel-amd64setldt-heap-overflow
* https://web.archive.org/web/20161028222346/https://www.securityfocus.com/archive/1/archive/1/537812/100/0/threaded
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1885
* https://www.mail-archive.com/[email protected]/msg132464.html
* https://svnweb.freebsd.org/base?view=revision&revision=296956
* https://wololo.net/2016/10/26/details-surface-ps4-4-01-jailbreak-potentially-enough-public-release-soon
==== Bug Description ====
The IA-32 architecture allows programs to define segments, which provides based and size-limited view into the program address space. The memory-resident processor structure, called Local Descriptor Table, usually abbreviated LDT, contains definitions of the segments. Since incorrect or malicious segments would breach system integrity, operating
systems do not provide processes direct access to the LDT, instead they provide system calls which allow controlled installation and removal of segments.
A special combination of sysarch(2) arguments, specify a request to uninstall a set of descriptors from the LDT. The start descriptor is cleared and the number of descriptors are provided. Due to lack of sufficient bounds checking during argument validity verification, unbound zero'ing of the process LDT and adjacent memory can be initiated from usermode.
sysarch is syscall #165 on FreeBSD 9.1 and on PS4. Sony removed set_ldt between System Software version 1.76 and 4.05, according to Red-EyeX32.
==== Exploit Implementation ====
==== Patched ====
'''Yes''' in some FW <= 4.05 and >= 2.00 as set_ldt was removed. The PS4 is maybe not vulnerable because of a possible lack of 32bit implementation for syscalls.
==== Tested ====
Not yet.
----
----


Please note that all contributions to PS4 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS4 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)

Templates used on this page:

Retrieved from "http://www.psdevwiki.com/ps4/Vulnerabilities"