Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
== | == WebKit/Userland Exploits == | ||
=== [[Internet_Browser#Webkit_exploit|FW <= 5.50 - haveABadTime Type Confusion]] === | |||
[ | |||
[ | |||
< | |||
==== Analysis ==== | ==== Analysis ==== | ||
[https://bugs.chromium.org/p/project-zero/issues/detail?id=1208 Project Zer0 Bug Description] | [https://bugs.chromium.org/p/project-zero/issues/detail?id=1208 Project Zer0 Bug Description] | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
When JSGlobalObject::haveABadTime() is called with arrays of a different JSGlobalObject type, type confusion can occur, leading to memory corruption. | When JSGlobalObject::haveABadTime() is called with arrays of a different JSGlobalObject type, type confusion can occur, leading to memory corruption. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[http://crack.bargains/550/ PS4 5.50 (WebKit Only)] | |||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in | '''Yes''' in 5.53 FW | ||
---- | ---- | ||
=== [[Internet_Browser#Webkit_exploit|FW <= 5.05 - setAttributeNodeNS Use-After-Free (UAF)]] === | |||
=== FW | |||
==== Analysis ==== | ==== Analysis ==== | ||
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/WebKit/setAttributeNodeNS%20UAF%20Write-up.md Specter's setAttributeNodeNS Exploit Writeup] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
By forcing setAttributeInternal() to call setAttributeNodeNS() twice, an attribute node reference will be added twice to the list. When one is free()'d, the second attribute still contains a duplicate stale reference, leading to a use-after-free (UAF) scenario. | By forcing setAttributeInternal() to call setAttributeNodeNS() twice, an attribute node reference will be added twice to the list. When one is free()'d, the second attribute still contains a duplicate stale reference, leading to a use-after-free (UAF) scenario. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit PS4 5.05 WebKit + Kernel Exploit] | [https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit PS4 5.05 WebKit + Kernel Exploit] | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 5. | '''Yes''' in 5.50 FW | ||
---- | ---- | ||
=== [[Internet_Browser#Webkit_exploit|FW <= 4.07 - Stack Uninitialized Read]] === | |||
=== FW | |||
==== Analysis ==== | ==== Analysis ==== | ||
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/4.0x%20WebKit%20Exploit%20Writeup.md Specter's 4.0x WebKit Exploit Writeup] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
Via a specially crafted valueOf() function of an arguments.length() function, non-zero indexes of the stack-allocated array are not initialized, leading to a stack uninitialized read. This can be abused to store a reference that can later be re-obtained post-GC (garbage collection) yielding a use-after-free() (UAF) situation. | Via a specially crafted valueOf() function of an arguments.length() function, non-zero indexes of the stack-allocated array are not initialized, leading to a stack uninitialized read. This can be abused to store a reference that can later be re-obtained post-GC (garbage collection) yielding a use-after-free() (UAF) situation. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[https://github.com/Cryptogenic/PS4-4.0x-Code-Execution-PoC] | |||
[https://gist.github.com/X41/36acd2a6939e4cebbecba45d35bf0d75 (mirror)] | |||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 4.50 FW | '''Yes''' in 4.50 FW | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3. | Works on 3.50. | ||
---- | ---- | ||
=== FW <= 3. | === [[Internet_Browser#Webkit_exploit|FW <= 3.70 - JSArray.sort() Use-After-Free (UAF)]] === | ||
==== Analysis ==== | ==== Analysis ==== | ||
[https://blog.xyz.is/2016/webkit-360.html HENKaku 3.60 Vita Writeup] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer isn't re-updated nor nulled. When this memory in free()'d, the reference is maintained and thus memory corruption can occur. | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[https://github.com/Fire30/PS4-3.55-Code-Execution-PoC PS4 3.55] | |||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in | '''Yes''' in 4.00 FW (3.70 on PS4 PRO models) | ||
---- | ---- | ||
=== [[Internet_Browser#Webkit_exploit|FW <= 2.03 - CSSSelector Heap Overflow (CVE-2014-1303)]] === | |||
=== FW <= | |||
== | |||
==== Analysis ==== | ==== Analysis ==== | ||
[https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not.PDF BlackHat EU 2014 'WebKit Everywhere - Secure Or Not?' slides] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
By forcing addRule() to be called on a CSS Selector via window.getMatchedCSSRules(), a 1-bit OOB write can be achieved and leveraged to corrupt heap memory. | By forcing addRule() to be called on a CSS Selector via window.getMatchedCSSRules(), a 1-bit OOB write can be achieved and leveraged to corrupt heap memory. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* | * Currently only has an ROP PoC for firmware [[2.030.000|2.03]] by Fire30: [https://github.com/Fire30/PS4-2014-1303-POC PS4 2.03] | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 2.50 FW | '''Yes''' in 2.50 FW | ||
==== Tested ==== | ==== Tested ==== | ||
* | * 2.03 | ||
---- | ---- | ||
=== FW <= | === [[Internet_Browser#Webkit_exploit|FW <= 1.76 - JSArray.sort() Heap Overflow (CVE-2012-3748)]] === | ||
==== Analysis ==== | ==== Analysis ==== | ||
[https://www.exploit-db.com/exploits/28081/ Exploit PoC by Vitaliy Toropov] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
By forcing the compare function to reduce the size of the array, trailing items will be written out of bounds (OOB write), leading to heap memory corruption. | By forcing the compare function to reduce the size of the array, trailing items will be written out of bounds (OOB write), leading to heap memory corruption. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[http://wololo.net/v/260.htm PSVita 2.60]<br/> | |||
[https://cturt.github.io/PS4-playground/ PS4 playground 1.76 by CTurt] | |||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 2.00 FW | '''Yes''' in 2.00 FW | ||
---- | |||
==== | === Additional Information === | ||
* On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | * On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | ||
== Kernel Exploits == | |||
=== FW <= 5.05 - BPF Race Condition (Yielding Double Free()) === | |||
==== Analysis ==== | ==== Analysis ==== | ||
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%205.05%20BPF%20Double%20Free%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 5.05 BPF Race Condition] | [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%205.05%20BPF%20Double%20Free%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 5.05 BPF Race Condition] | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
Again due to improper locking, two threads can enter the BPF "SETWF" ioctl command handler. While the bug is similar to that of 4.55, the method of attack is slightly different. Since write() was removed for BPF in 4.70, instead of triggering a use-after-free with write() - "SETWF" is ran in parallel via threading. Eventually, both calls will copy the same pointer to the stack, leading to both threads free()'ing the same pointer, poisoning the freelist. This can later be leveraged via heap spraying to corrupt heap memory to obtain arbitrary code execution in supervisor mode (ring0). | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[http://crack.bargains/505k/ PS4 5.05 WebKit + Kernel Exploit]<br/> | |||
[https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit PS4 5.05 WebKit + Kernel Exploit Source] | |||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 5. | '''Yes''' in 5.50FW | ||
---- | ---- | ||
=== FW <= 4.55 - BPF Race Condition (Yielding UaF) === | === FW <= 4.55 - BPF Race Condition (Yielding UaF) === | ||
==== Analysis ==== | ==== Analysis ==== | ||
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 4.55 BPF Race Condition] | [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 4.55 BPF Race Condition] | ||
Line 1,275: | Line 99: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 4. | '''Yes''' in 4.70FW | ||
---- | ---- | ||
=== FW <= 4.05 - NamedObj Type Confusion (namedobj) === | |||
=== FW <= | |||
==== Analysis ==== | ==== Analysis ==== | ||
[https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's Writeup of the <= 4.05 Kernel Exploit]<br/> | |||
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's Writeup of 4.05 Implementation] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
Type confusion in the namedobj system once exploited can lead to an arbitrary free() allowing an attacker to craft a use-after-free() (UAF) situation to corrupt kernel memory. This can be leveraged to eventually obtain an arbitrary code execution primitive in supervisor mode (ring0). | |||
-- | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit] | [https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit] | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 4.06 FW | '''Yes''' in 4.06 FW | ||
---- | ---- | ||
=== FW <= 1.76 - Dynamic Library Prepare Close (dlclose) === | |||
=== FW <= 1.76 - dlclose | |||
==== Analysis ==== | ==== Analysis ==== | ||
[http://cturt.github.io/dlclose-overflow.html Analysis of sys_dynlib_prepare_dlclose PS4 kernel heap overflow (by CTurt with the help of | [http://cturt.github.io/dlclose-overflow.html Analysis of sys_dynlib_prepare_dlclose PS4 kernel heap overflow (by CTurt with the help of qwertyoruiopz)] | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
Line 1,412: | Line 128: | ||
'''Yes''' in 2.00 FW | '''Yes''' in 2.00 FW | ||
---- | ---- | ||
=== FW <= 1.76 - BadIRET === | |||
=== FW <= 1.76 - BadIRET | |||
==== Analysis ==== | ==== Analysis ==== | ||
[http://cturt.github.io/ps4-3.html Hacking the PS4, part 3 - Kernel exploitation (by '''CTurt''')]<br/> | |||
[https://nvd.nist.gov/vuln/detail/CVE-2014-9322 NVD Bug Description] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
Faults associated with the stack segment (SS) register are not handled properly, allowing unprivileged users to trigger an IRET instruction that accesses a GS Base from | Faults associated with the stack segment (SS) register are not handled properly, allowing unprivileged users to trigger an IRET instruction that accesses a GS Base from userland memory, providing an attacker with a method of privilege escalation. | ||
==== | ==== Source ==== | ||
[http://seclists.org/oss-sec/2015/q3/66 CVE-2014-9322] | |||
<br/>[http://www.filedropper.com/ps4-bad-iret-5fs Public binary] | |||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 2.00 FW | '''Yes''' in 2.00 FW | ||
==== Implementation ==== | ==== Implementation ==== | ||
[https://mega.nz/#!Fo1xFDrb!EuOl5s6g_IPTtI6dAknSKYJZ8YLzZWvx1MPUPmkr3Sg (mirror)] | |||
---- | ---- | ||
=== Additional Information === | |||
* It seems at some point after the 1.76 FW, ASLR (Address Space Layout Randomization) was enabled in the kernel. This means that to properly exploit the kernel to escalate privileges, an information disclosure vulnerability will most likely be needed to defeat ASLR and locate the kernel in memory. | |||
* It seems in 5.0x FW and above, a new custom mitigation was added to the kernel to prevent exploiters from pivoting the stack pointer into userland memory (attemping to do so will crash the system). A new exploitation strategy is needed for running kROP (kernel ROP) chains, such as qwertyoruiopz method used in the 5.05 BPF kernel exploit. | |||
== | == First Steps == | ||
==== VidNow ==== | |||
==== | A possible exploit has been found in VidNow App in the Playstation Store App . | ||
PATCHED: Sony has hotfixed this exploit via content hashing the file while in transit. | |||
UPDATE: Some have managed to reverse the hotfix but the method is not known - the PS4 checks the content | |||
hash HTTP header from the HMAC header. | |||
==== SnagFilms ==== | |||
A possible exploit has been found in the SnagFilms App in the Playstation Store App. | |||
Arbitrary code execution in memory has been demonstrated, although so far the system will throw an exception in the programs memory before the payload finishes loading. | |||
If you craft a small enough payload and/or a payload that load's without causing an exception in program memory you can most likely get code execution working. | |||
http://i.imgur.com/5OrSFCa.jpg | |||
{{Reverse Engineering}} | {{Reverse Engineering}} | ||
<noinclude> | <noinclude>[[Category:Main]]</noinclude> | ||
[[Category:Main]] | |||
</noinclude> |