Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
== | == Hardware Exploits == | ||
=== | === PCIe man-in-the-middle attack === | ||
* First done on 1.01 by failoverflow on PS4 launch ! | |||
* Detailed at 33c3: [https://fail0verflow.com/media/33c3-slides/#/5 33c3 slides by Marcan] | |||
* Permits kernel and userland dumping | |||
* | |||
* | |||
* | |||
=== | === syscon glitching === | ||
It is possible to glitch the syscon debug interface to allow access and dump keys. Originally done by an anonymous member of fail0verflow. | |||
=== | === Aeolia/Belize SCA/DPA === | ||
Aeolia side channel analysis with differential power analysis has been shown to be able to recover key material on all PS4 models. Since Sony never used private/public key pairs, it is possible to exploit this and gain complete control over the southbridge. You can attack the main FreeBSD kernel from here. | |||
==== | == WebKit/Userland Exploits == | ||
=== FW 6.00-6.72 - bad_hoist exploit (CVE-2018-4386) === | |||
=== FW 6.00-6.72 - bad_hoist | |||
==== Credits ==== | ==== Credits ==== | ||
* Lokihardt (from Google Project Zer0) for the exploit PoC (Sep 13, 2018) | * Lokihardt (from Google Project Zer0) for the exploit PoC (Sep 13, 2018) | ||
* Fire30 for turning the vulnerability into exploit for PS4 (Dec 30, 2019) | * Fire30 for turning the vulnerability into exploit for PS4 (Dec 30, 2019) | ||
==== Analysis ==== | ==== Analysis ==== | ||
Line 465: | Line 28: | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary | WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary doesn't invalidate the ForInContext object. | ||
It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated. | It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
Line 479: | Line 40: | ||
---- | ---- | ||
=== FW | === FW 6.00-6.20 - JSArray::shiftCountWithArrayStorage() OOB RW (CVE-2018-4441) === | ||
==== Credits ==== | ==== Credits ==== | ||
Line 506: | Line 48: | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1685 | * [https://bugs.chromium.org/p/project-zero/issues/detail?id=1685 bug report by Lokihardt (Oct 3, 2018)] | ||
* [https://github.com/WebKit/webkit/commit/51a62eb53815863a1bd2dd946d12f383e8695db0 | * [https://github.com/WebKit/webkit/commit/51a62eb53815863a1bd2dd946d12f383e8695db0 Fix commit (Oct 15, 2018)] | ||
* [https://mastodon.social/@buherator/101654714198519755 Announce of incoming write-up by rkmylo and buherator/stratan/@5tratan, Meligra Team (Feb 25, 2019)] | * [https://mastodon.social/@buherator/101654714198519755 Announce of incoming write-up by rkmylo and buherator/stratan/@5tratan, Meligra Team (Feb 25, 2019)] | ||
* [https://rstforums.com/forum/topic/110439-cve-2018-4441-oob-rw-via-jsarrayunshiftcountwitharraystorage-webkit/ Write-up | * [https://rstforums.com/forum/topic/110439-cve-2018-4441-oob-rw-via-jsarrayunshiftcountwitharraystorage-webkit/ Write-up by Nytro, Meligra Team (Feb 27, 2019)] | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
Line 518: | Line 59: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 6.50 FW | '''Yes''' in 6.50 FW | ||
---- | ---- | ||
=== FW 6.00-6.20 - JSC::arrayProtoPrivateFuncConcatMemcpy() Information Leak (CVE-2018-4358) | === FW 6.00-?6.20? - JSC::arrayProtoPrivateFuncConcatMemcpy() Information Leak (CVE-2018-4358) === | ||
==== Credits ==== | ==== Credits ==== | ||
* bkth, niklasb and saelo (from phoenhex Team) for the exploit PoC in Safari (Sep 26, 2018) | * bkth, niklasb and saelo (from phoenhex Team) for the exploit PoC in Safari (Sep 26, 2018) | ||
* Vultra for discovering that the exploit worked | * Vultra for discovering that the exploit worked since FW 6.00 (Dec 10, 2018) | ||
==== Analysis ==== | ==== Analysis ==== | ||
* https://github.com/WebKit/webkit/commit/b68b373dcbfbc68682ceeca8292c5c0051472071 | * https://github.com/WebKit/webkit/commit/b68b373dcbfbc68682ceeca8292c5c0051472071 | ||
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4358 | * https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4358 | ||
Line 544: | Line 80: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 6.50 FW | '''Yes''' in 6.50/1 FW | ||
==== Tested ==== | ==== Tested ==== | ||
Line 550: | Line 86: | ||
---- | ---- | ||
=== FW 4.50-5.56 - JSGlobalObject::haveABadTime() Type Confusion (CVE-2017-7005) | === FW 4.50-5.56 - JSGlobalObject::haveABadTime() Type Confusion (CVE-2017-7005) === | ||
==== Credits ==== | ==== Credits ==== | ||
Line 572: | Line 108: | ||
---- | ---- | ||
=== FW | === FW 5.05 - Document::adoptNode UaF === | ||
==== Credits ==== | ==== Credits ==== | ||
* Lokihardt (from Google Project Zer0) for the exploit PoC (Jan 23, 2017) | * Lokihardt (from Google Project Zer0) for the exploit PoC (Jan 23, 2017) | ||
* CelesteBlue for testing on PS4 and | * CelesteBlue for testing on PS4 and PSVita | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://bugs.chromium.org/p/project-zero/issues/detail?id=1099 exploit report by Lokihardt (Jan 23, 2017)] | * [https://bugs.chromium.org/p/project-zero/issues/detail?id=1099 exploit report by Lokihardt (Jan 23, 2017)] | ||
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2468 | * [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2468 mitre report] | ||
* [https://www.exploit-db.com/exploits/41868 exploitDB report] | * [https://www.exploit-db.com/exploits/41868 exploitDB report] | ||
* [https://bugs.chromium.org/p/chromium/issues/detail?id=541206 related bug (Oct 8, 2015)] | |||
* [https://bugs.chromium.org/p/chromium/issues/detail?id=541206 | * Test on PSVita FW 3.60 by CelesteBlue (May 9, 2020) | ||
* Test on PS4 FW 5.05 by CelesteBlue (Aug 20, 2020) | |||
* | |||
* | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* PoC | * [https://github.com/Metnew/uxss-db/tree/master/webkit/CVE-2017-2468 PoC that just crashes on PS4 FW 5.05] | ||
==== Patched ==== | ==== Patched ==== | ||
''' | '''Maybe''' in ?6.00? FW. | ||
---- | ---- | ||
=== FW 4.50-5.01 - Element::setAttributeNodeNS | === FW 4.50-5.01 - Element::setAttributeNodeNS UAF === | ||
==== Credits ==== | ==== Credits ==== | ||
Line 641: | Line 153: | ||
---- | ---- | ||
=== FW 3.15-4.07 - Stack Uninitialized Read | === FW 3.15-4.07 - Stack Uninitialized Read UAF === | ||
==== Credits ==== | ==== Credits ==== | ||
Line 661: | Line 173: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3.15-4.07. Not working on <= 3.11 | Works on 3.15-4.07. Not working on <=3.11. | ||
---- | ---- | ||
=== FW 3.15-3.70 - JSArray::sortCompactedVector() Heap | === FW 3.15-3.70 - JSArray::sortCompactedVector() Heap UAF === | ||
==== Credits ==== | ==== Credits ==== | ||
Line 719: | Line 184: | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://blog.xyz.is/2016/webkit-360.html PSVita 3.60 | * [https://blog.xyz.is/2016/webkit-360.html PSVita 3.60 HENKaku webkit exploit writeup] | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer | When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer isn't re-updated nor nulled. When this memory in free()'d, the reference is maintained and thus memory corruption can occur. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [https://github.com/henkaku/henkaku/blob/master/webkit/exploit.js PSVita 3.60 | * [https://github.com/henkaku/henkaku/blob/master/webkit/exploit.js PSVita 3.60 webkit exploit by xyz] | ||
* [https://github.com/Fire30/PS4-3.55-Code-Execution-PoC PS4 playground 3.15-3.70 by Fire30] | * [https://github.com/Fire30/PS4-3.55-Code-Execution-PoC PS4 playground 3.15-3.70 by Fire30] | ||
* [https://github.com/Cryptogenic/PS4-Playground-3.55 Improved PS4 playground 3.15-3.70 by Specter] | * [https://github.com/Cryptogenic/PS4-Playground-3.55 Improved PS4 playground 3.15-3.70 by Specter] | ||
Line 736: | Line 201: | ||
---- | ---- | ||
=== FW <= 3.50 - WebCore::TimerBase::heapPopMin() | === FW <= 3.50 - WebCore::TimerBase::heapPopMin Heap UAF (only crash for now) === | ||
==== Analysis ==== | ==== Analysis ==== | ||
* | * https://github.com/WebKit/webkit/commit/98845d940e30529098eea7e496af02e14301c704 | ||
* | * https://xz.aliyun.com/t/292 | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
"As of firmware version 3.55 a patch has been included to prevent a use-after-free segmentation fault from being exploited. This could have led to a ROP chain and code execution. It would have been cool if someone would have done some real research on it..." | "As of firmware version 3.55 a patch has been included to prevent a use-after-free segmentation fault from being exploited. This could have led to a ROP chain and code execution. It would have been cool if someone would have done some real research on it..." | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [http://psxhax.com/threads/ps4-3-50-webkit-exploit-from-playstation-4-dev-qwertyoruiop.450/ Article about qwertyoruiop's tests ( | * [http://psxhax.com/threads/ps4-3-50-webkit-exploit-from-playstation-4-dev-qwertyoruiop.450/ Article about qwertyoruiop's tests (20-05-2016)] | ||
* [http://psxhax.com/threads/ps4-heap-use-after-free-at-webcore-3-50-poc-by-hunter128.452/ Article about initial PoC for PS4 ( | * [http://psxhax.com/threads/ps4-heap-use-after-free-at-webcore-3-50-poc-by-hunter128.452/ Article about initial PoC for PS4 (21-05-2016)] | ||
* [http://wololo.net/talk/viewtopic.php?t=45888 Initial PoC for PS4 ( | * [http://wololo.net/talk/viewtopic.php?t=45888 Initial PoC for PS4 (21-05-2016)] | ||
* [https://web.archive.org/web/20161030085033/http://cryptoanarchic.me/wat.txt iOS 9.3.2 WebKit RCE via heapPopMin (2016 | * [https://web.archive.org/web/20161030085033/http://cryptoanarchic.me/wat.txt iOS 9.3.2 WebKit RCE via heapPopMin (07-2016)] | ||
* [https://twitter.com/qwertyoruiopz/status/756268361282125824 qwertyoruiop's tweet ( | * [https://twitter.com/qwertyoruiopz/status/756268361282125824 qwertyoruiop's tweet (22-07-2016)] | ||
* [https://github.com/Jailbreaks/jbme/tree/master mirror of iOS 9.3.2 WebKit RCE via heapPopMin] | * [https://github.com/Jailbreaks/jbme/tree/master mirror of iOS 9.3.2 WebKit RCE via heapPopMin] | ||
Line 760: | Line 222: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3.15, 3.50 | Works on 3.15, 3.50 FW. | ||
---- | ---- | ||
=== FW <= 2.03 - WebCore::CSSSelector Heap Overflow (CVE-2014-1303) === | |||
=== FW <= 2.03 - WebCore::CSSSelector Heap Overflow (CVE-2014-1303) | |||
==== Credits ==== | ==== Credits ==== | ||
Line 814: | Line 250: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 2.50 FW | '''Yes''' in 2.50 FW | ||
==== Tested ==== | ==== Tested ==== | ||
Line 857: | Line 255: | ||
---- | ---- | ||
=== FW <= 1.76 - JSArray::sort() Heap Overflow (CVE-2012-3748, PSA 2013-0903-1) | === FW <= 1.76 - JSArray::sort() Heap Overflow (CVE-2012-3748, PSA 2013-0903-1) === | ||
==== Credits ==== | ==== Credits ==== | ||
* Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013) | * Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013) | ||
* nas and Proxima for the first PS4 POC on 1.76 PS4 ( | * nas and Proxima for the first PS4 POC on 1.76 PS4 (Oct. 23, 2014) | ||
* sony for patching the exploit in FW 2.00 ( | * sony for patching the exploit in FW 2.00 (Oct 27, 2014) | ||
* CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849] | * CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849] | ||
Line 881: | Line 279: | ||
* [http://daxhordes.org/ps4_176/ps4_rop2.html ROP2] | * [http://daxhordes.org/ps4_176/ps4_rop2.html ROP2] | ||
* [https://cturt.github.io/PS4-playground/ PS4 playground 1.76 by CTurt] | * [https://cturt.github.io/PS4-playground/ PS4 playground 1.76 by CTurt] | ||
* [https://bitbucket.org/DaveeFTW/psvita-260-webkit/src/master/ PSVita 2.00-3.20 | * [https://bitbucket.org/DaveeFTW/psvita-260-webkit/src/master/ PSVita 2.00-3.20 webkit exploit] | ||
==== Patched ==== | ==== Patched ==== | ||
Line 887: | Line 285: | ||
==== Tested ==== | ==== Tested ==== | ||
* Working on | * Working on 1.01-1.76 FW. | ||
== | == Userland securities == | ||
=== Userland ASLR === | |||
* Very old firmwares (<= 1.05) don't have ASLR enabled, but it was introduced sometime before firmware 1.70. "Address Space Layout Randomization" (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4. | |||
* To defeat userland ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address. | |||
* Very old firmwares (<= 1.05) | |||
* To defeat | |||
=== Module imports table cleaned before execution === | === Module imports table cleaned before execution === | ||
* Between 1.76 and 4.05, Sony did that to prevent | * Between 1.76 and 4.05, Sony did that to prevent webkit exploiters from defeating userland ASLR easily. | ||
* Now we have to dump entire | * Now we have to dump entire userland sandboxed memory, and by studying it we can defeat ASLR: | ||
1. Chose a function (ex: __stack_chk_fail) imported from | 1. Chose a function (ex: __stack_chk_fail) imported from LibKernel by SceWebkit2 | ||
2. Read pointer contained at the address where the call is done | 2. Read pointer contained at the address where the call is done | ||
3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | 3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | ||
4. This result is LibKernel base address. This method works for any imported module. | 4. This result is LibKernel base address. This method works for any imported module. | ||
=== DEP / NX === | === DEP / NX === | ||
* "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to userland memory then executing it. | |||
* "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to | |||
* 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs). | * 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs). | ||
=== JiT removed from webbrowser === | === JiT removed from webbrowser === | ||
* On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | * On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | ||
* Workaround is to use ROP. | * Workaround is to use ROP. | ||
=== Syscalls removed === | === Syscalls removed === | ||
=== Syscall 0 disabled i.e Error Kernel: The application directly issues a syscall instruction (24) === | |||
* Between 2.00 and 2.57, SCE has removed system call 0, so we can no longer call any syscall we want by specifying the call number in the rax register. | |||
* Doing so now crashes the app and gives error CE-34878-0, SCE_KERNEL_ABORT_REASON_SYSTEM_ILLEGAL_FUNCTION_CALL, with the message "Kernel: The application directly issues a syscall instruction (24)". | |||
Between 2.00 and 2.57, SCE has | * We now have to use wrappers provided to us from the libkernel / libkernel_web / libkernel_sys modules to access system calls. | ||
* | |||
=== bpf_write function stripped out of the kernel === | === bpf_write function stripped out of the kernel === | ||
Line 975: | Line 324: | ||
=== bpf_open function blocked for unprivileged processes === | === bpf_open function blocked for unprivileged processes === | ||
* On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF. | * On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF. | ||
=== bpf_ioctl function blocked or removed === | === bpf_ioctl function blocked or removed === | ||
* Moreover, on FW 5.50+, opening BPF is still possible in less sandboxed apps like test/devkits fselfs. But this is useless because ioctl doesn't work. | |||
* | |||
=== Device access blocked/removed from webbrowser === | === Device access blocked/removed from webbrowser === | ||
* Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from | * Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from webbrowser | ||
== Kernel Exploits == | |||
=== FW <= 7.02 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) === | |||
< | |||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://hackerone.com/reports/826026 TheFloW's report of the exploit with a FreeBSD 9-12 PoC] | |||
* [https://hackerone.com/reports/826026 TheFloW's | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
Due to missing locks in option IPV6_2292PKTOPTIONS of setsockopt, it is possible to race and free the struct ip6_pktopts buffer, while it is being handled by ip6_setpktopt. This structure contains pointers (ip6po_pktinfo) that can be hijacked to obtain arbitrary kernel R/W primitives. As a consequence, it is easy to have kernel code execution. This vulnerability is reachable from WebKit sandbox and is available in the latest FW, that is 7.02. | Due to missing locks in option IPV6_2292PKTOPTIONS of setsockopt, it is possible to race and free the struct ip6_pktopts buffer, while it is being handled by ip6_setpktopt. This structure contains pointers (ip6po_pktinfo) that can be hijacked to obtain arbitrary kernel R/W primitives. As a consequence, it is easy to have kernel code execution. This vulnerability is reachable from WebKit sandbox and is available in the latest FW, that is 7.02. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [ | * [https://hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com/Y13EyQCGKEqxH8PpJgFKh5uY?response-content-disposition=attachment%3B%20filename%3D%22exploit.c%22%3B%20filename%2A%3DUTF-8%27%27exploit.c&response-content-type=text%2Fx-c%2B%2Bsrc&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAQGK6FURQ4G43T3HL%2F20200719%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20200719T222620Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEGUaCXVzLXdlc3QtMiJHMEUCIQD%2F0c09Z1wbdZi9kMJukdNUryexRJUKWxTiqcoAnsxE1gIgQqef8QiWKjHnPYTPLZO5P1KcXixsUrL2Z8AnnT404jEqtAMIHRABGgwwMTM2MTkyNzQ4NDkiDGkLHbTp2BRWlnoy5iqRA0gx69uKt57lUwOOB48RT1j6IEwp5FGjfVUviEc78dJ99qZaUUB%2FI%2BfRDN5J7OKceSsOZwZ1VebLhz2za2R2c5gjX9EtCWf%2Brl6EIvxMXSyC%2FYxnbAVAXvB8jf5sRWr%2FgqpUQbNr1V5JFbe6IYw%2FvlmiYqMzhSqBpupfI6E6cwa3luTr0GBWKR4lppzFXR7%2B6e9bUAC%2BQiQcPk%2FzNqKAGE%2FFKkDreC1Vvlct%2FvhqQ0HbaNesEQG%2F0qbv2%2B6UB9iU4n4uk369G%2BmwtnfEh0%2BEeptwYVwFApNIfwRdOXx%2FrPnL69fkuxjA8BKQpILIf2XYxrbtlE8Nth8z75cXxlFLgdfmhyidy2Q0wkjS45tx39ROJZQBC9g%2Fstx7u0jFZ1M3MJuBVJc%2FO5aWCPOBoZrQKpbAJqHSqF5x5ON3x%2BNkFbfMj%2B20qSfmBn7eT2FYBPR3bahKnI5lZeDzYAQgSIvUpAGW%2Fi2UL1ZmEqEKoV%2Fh67YYzCMzM3uUqPRuSGIeQsmUEQeY%2BjR7PPoR71928%2B%2FHFBbTMN%2FW0vgFOusB5oRuVzVviKnOLIHgixiK0h5rYZe5TfP3JtYhhy3XpV0RB3BliMzTvuhn5TevB9ZZlRYKnP7x08C888AIsUKSm3UuQpHmnZ1M5yeypI5MwjmLO51lBnQwigz0tHGDu2jlOLyvW9bXzFw1rNLSfM5x6dWmvMdYyTkStTFnwcN0V14U5EOVzdfo9WYogPfzq%2FEeOopTjDAusDtIBEtn4ILZxnlPxi8oLY8rI03lsF4GmRx6zQKJ%2Bzs44lQi5DRSMOueKTvWmPRaR83hUAIxlXdDCdM8wPYQe0eMl3V3macYTRK1FghrvW4BCo6ZqQ%3D%3D&X-Amz-Signature=2862cc641fee752f041d00f7d021826e09354ef202bb2da78a966e5b90830662 TheFloW's PoC for FreeBSD 9 and 12] | ||
* [https://github.com/sleirsgoevy/ps4jb PS4 6.72 | * [https://github.com/sleirsgoevy/ps4jb PS4 6.72 WebKit + Kernel Exploit implementation by sleirsgoevy] | ||
* [https://github.com/ChendoChap/ps4-ipv6-uaf PS4 5.05- | * [https://github.com/ChendoChap/ps4-ipv6-uaf PS4 5.05-6.72 WebKit + Kernel Exploit implementation by ChendoChap] | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in | '''Yes''' in 7.50 FW | ||
---- | ---- | ||
Line 1,278: | Line 384: | ||
---- | ---- | ||
=== FW <= 6.00 ?6.02? - sys_getcontext Information Leak (kASLR defeat | === FW <= 6.00 ?6.02? - sys_getcontext Information Leak (kASLR defeat) === | ||
==== Analysis ==== | ==== Analysis ==== | ||
Line 1,319: | Line 425: | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the | * [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the 1.01-4.05 namedobj kernel exploit] (2017-10-19) | ||
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20) | * [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20) | ||
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his | * [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his 4.05 implementation] (2017-12-28) | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
Line 1,329: | Line 433: | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit] | |||
==== Patched ==== | ==== Patched ==== | ||
Line 1,335: | Line 439: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on FWs 4.00-4.05. On <= 3.70 FW we | Works on FWs 4.00-4.05. On <=3.70 FW we haven't found a way to leak the target object, but it might be doable as F0F did it on 1.01. | ||
---- | ---- | ||
=== FW <= 1.76 - dlclose Kernel Heap Overflow === | === FW <= 1.76 - dlclose Kernel Heap Overflow === | ||
* Discovered by CTurt. Privately implemented thanks to qwertyoruiop. CTurt published a writeup then the exploit was publicly implemented by kR105 and on another side by Zer0xFF and Bigboss (psxdev). | |||
* Discovered by CTurt. | |||
==== Analysis ==== | ==== Analysis ==== | ||
Line 1,413: | Line 459: | ||
---- | ---- | ||
=== FW <= 1.76 - BadIRET | === FW <= 1.76 - BadIRET === | ||
==== Analysis ==== | ==== Analysis ==== | ||
* | * Ported from FreeBSD 9 to PS4 by CTurt. | ||
[http://cturt.github.io/ps4-3.html Hacking the PS4, part 3 - Kernel exploitation (by '''CTurt''')]<br/> | |||
[https://nvd.nist.gov/vuln/detail/CVE-2014-9322 NVD Bug Description] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
Faults associated with the stack segment (SS) register are not handled properly, allowing unprivileged users to trigger an IRET instruction that accesses a GS Base from | Faults associated with the stack segment (SS) register are not handled properly, allowing unprivileged users to trigger an IRET instruction that accesses a GS Base from userland memory, providing an attacker with a method of privilege escalation. | ||
==== | ==== Source ==== | ||
[http://seclists.org/oss-sec/2015/q3/66 CVE-2014-9322] | |||
<br/>[http://www.filedropper.com/ps4-bad-iret-5fs Public binary] | |||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 2.00 FW | '''Yes''' in 2.00 FW | ||
=== | ==== Implementation ==== | ||
[https://mega.nz/#!Fo1xFDrb!EuOl5s6g_IPTtI6dAknSKYJZ8YLzZWvx1MPUPmkr3Sg (mirror)] | |||
==== | |||
== Kernel securities == | == Kernel securities == | ||
=== Kernel ASLR === | === Kernel ASLR === | ||
* Since 3.50 FW, ASLR (Address Space Layout Randomization) has been enabled in PS4 kernel. | |||
Since 3.50 FW, ASLR (Address Space Layout Randomization) has been enabled in PS4 kernel. This means that to properly exploit the kernel to escalate privileges, an information disclosure vulnerability will most likely be needed to defeat ASLR and locate the kernel in memory. | * This means that to properly exploit the kernel to escalate privileges, an information disclosure vulnerability will most likely be needed to defeat ASLR and locate the kernel in memory. | ||
=== Kernel SMAP === | === Kernel SMAP === | ||
* In 5.0x FW and above, "Supervisor Mode Access Prevention" (SMAP), a new custom mitigation was added to the kernel to prevent exploiters from pivoting the kernel stack pointer into userland memory (attempting to do so would crash the system). | |||
* A new exploitation strategy is needed to run kernel ROP chains, such as qwertyoruiop method used in the 5.05 BPF kernel exploit:<br /> | |||
We need to get our ROP chain into kernel memory. To do this, qwertyoruiop decided to go with the method he used on the iPhone 7 - essentially using JOP to push a bunch of stack frames onto the kernel stack, and memcpy()'ing the chain into RSP. | |||
To | |||
{{Reverse Engineering}} | {{Reverse Engineering}} | ||
<noinclude> | <noinclude>[[Category:Main]]</noinclude> | ||
[[Category:Main]] | |||
</noinclude> |