Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
== | == Hardware Exploits == | ||
=== | === PCIe man-in-the-middle attack === | ||
* First done on 1.01 by failoverflow on PS4 launch ! | |||
* Detailed at 33c3: [https://fail0verflow.com/media/33c3-slides/#/5 33c3 slides by Marcan] | |||
* Permits kernel and usermode dumping | |||
=== Syscon glitching === | |||
It is possible to glitch the [[Syscon]] debug interface to allow access and dump keys. It was originally done by an anonymous member of fail0verflow. | |||
=== Aeolia and Belize (Southbridge) SCA/DPA === | |||
Side Channel Analysis (SCA) with Differential Power Analysis (DPA) on Aeolia and Belize (PS4 Southbridge revisions) has been shown to be able to recover key material. Since Sony never used private/public key pairs, it is possible to exploit this and gain complete control over the [[Southbridge]]. You can attack the main FreeBSD kernel from here. | |||
Nearly same methods are working on recent PS4 Pro motherboard NVB-003 that has Belize [[Southbridge]] ([[CXD90046GG]]). | |||
Contrarly to Aeolia, Belize has ROM readout protection and clears stack which makes it more secure. | |||
Old notes: | |||
This is a hack to gain unsigned code execution on the [[Southbridge]] for all motherboard/console revisions. You might be able to glitch the EMC bootrom in order to bypass further signature checks and break the chain of trust. This hack might involve slowing down the [[Syscon]] clock. Timing the glitch based on SPI read accesses then either doing a power glitch or clock glitch to skip signature check. If the glitch fails, then we simply reset. This can be done with a very cheap CPLD/FPGA. Most Xbox 360 glitching modchips used a Xilinx Coolrunner because it is cheap and easy to use (board can cost as low as $5). | |||
Related: | |||
* | * [https://fail0verflow.com/blog/2018/ps4-aeolia/ fail0verflow's writeup] | ||
* | * [https://twitter.com/fail0verflow/status/1047690778527653889 fail0verflow's tweet] | ||
* | * [https://www.youtube.com/watch?v=sMroXa-zYxk Playstation 4 Rest Mode DEMO REcon Brussels 2018 by Volodymyr Pikhur] | ||
* [https://recon.cx/2018/brussels/resources/slides/RECON-BRX-2018-Mess-with-the-best-die-like-the-rest_(mode).pdf Slides of REcon Brussels 2018 by Volodymyr Pikhur] | |||
* [https://www.psxhax.com/threads/ps4-southbridge-reverse-engineered-code-examination-by-jogolden.6736/ jogolden's writeup] | |||
==== | == Usermode Exploits (Game Savedata) == | ||
==== | === PS2 games savedata exploits === | ||
==== | ==== GTA III ==== | ||
* [https://github.com/halpz/re3/blob/9a7fa478578beaba947ea867c15a25e411d641d8/src/save/MemoryCard.cpp#L358 vulnerability] | |||
* [https://github.com/ | |||
The game does a copy from the memory card into a fixed-size buffer with size supplied by the savedata. | |||
=== | ==== Dark Cloud ==== | ||
* [https://www.youtube.com/results?search_query=%22dark+cloud%22+item+glitch+menu+before%3A2008-01-01 video of bug triggering] | |||
* | |||
Moving the cursor and pressing X on the same frame in the items menu allows us to pick up an item from out-of-bounds memory, which results in exploitable behaviour. | |||
==== Okage Shadow King ==== | |||
* [https://store.playstation.com/en-us/product/UP9000-CUSA02199_00-SCUS971290000001 PS4 digital version CUSA02199 of SCUS97129 on PS Store] | |||
It has a typical stack buffer oveflow if you extend the player/town name in a savedata. | |||
Okage Shadow King for PS4 (CUSA02282) base version (1.00) requires FW version 3.15, although it was compiled with SDK version 3.008.000. Okage Shadow King for PS4 (CUSA02199 and CUSA02282) patch 1.01 requires FW version 4.05. | |||
=== PS4/PS5 PS2emu sandbox escape (mast1c0re) === | |||
==== Credits ==== | |||
* CTurt for discovering these vulnerabilities in September 2021 | |||
* CTurt for public disclosure [https://twitter.com/CTurtE/status/1570189920844804097 on twitter] (2020-09-15) | |||
* flatz, balika011, theflow0, chicken(s), PlayStation for helping CTurt | |||
==== Analysis ==== | |||
* [https://cturt.github.io/mast1c0re.html Writeup by CTurt (2022-09-14)] | |||
==== Bug description ==== | |||
After getting code execution in a PS2onPS4 game using a savedata exploit, it is possible to exploit the PS2 emulator to get x86-64 usermode ROP execution. It is then possible, without a kernel exploit, to load another PS2 game in the emulator with a compatibility rate based on the PS2 emulator configuration. | |||
==== | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* | * None | ||
==== Patched ==== | ==== Patched ==== | ||
'''No''' as of PS4 FW | '''No''' as of PS4 FW 10.01 and PS5 FW 6.50. Using the game Okage Shadow King, the exploit should work starting from PS4 FW 3.15 and PS5 FW 1.00. | ||
== Usermode Exploits (BD-J) == | == Usermode Exploits (BD-J) == | ||
Advantages of most BD-J exploits over most WebKit exploits: | Advantages of most BD-J exploits over most WebKit exploits: | ||
* Bigger kernel attack surface (more usermode privileges) versus WebKit very restricted and becoming more and more with firmware revisions | * Bigger kernel attack surface (more usermode privileges) versus WebKit very restricted and becoming more and more with firmware revisions | ||
* 100% reliable versus WebKit exploits becoming less and less stable with firmware revisions | * 100% reliable versus WebKit exploits becoming less and less stable with firmware revisions | ||
* Firmware agnostic (ROP-less code execution) versus almost one WebKit revision every three firmware update | * Firmware agnostic (ROP-less code execution) versus almost one WebKit revision every three firmware update | ||
* JIT enabled allowing to write a kernel exploit in C versus writing in assembly and JavaScript since around FW 2.00 | * JIT enabled allowing to write a kernel exploit in C versus writing in assembly and JavaScript since around FW 2.00 | ||
=== FW <=9.00 - Five vulnerabilities chained by TheFloW === | |||
=== FW <= 9.00 | |||
==== Credits ==== | ==== Credits ==== | ||
* CTurt for [https://github.com/CTurt/FreeDVDBoot FreeDVDBoot exploit on PS2] and the idea to hack BD-J on PS3 and PS4 [https://twitter.com/CTurtE/status/1276946283941498881 on twitter] (2020-06-27) | * CTurt for [https://github.com/CTurt/FreeDVDBoot FreeDVDBoot exploit on PS2] and the idea to hack BD-J on PS3 and PS4 [https://twitter.com/CTurtE/status/1276946283941498881 on twitter] (2020-06-27) | ||
* | * TheFlow for finding these vulnerabilities (around 2021-10-24) and disclosing them publicly on hackerone and hardwear.io (2022-06-10) | ||
* Sleirsgoevy for writing the first public implementation (2022-06-16) | * Sleirsgoevy for writing the first public implementation (2022-06-16) | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://hackerone.com/reports/1379975 Official vulnerability report by TheFloW (2022-06-10)] | * [https://hackerone.com/reports/1379975 Official vulnerability report by TheFloW (2022-06-10)] | ||
* [https://github.com/TheOfficialFloW/Presentations/blob/master/2022-hardwear-io-bd-jb.pdf Slides presented at hardwear.io by TheFloW (2022-06-10)] | * [https://github.com/TheOfficialFloW/Presentations/blob/master/2022-hardwear-io-bd-jb.pdf Slides presented at hardwear.io by TheFloW (2022-06-10)] | ||
==== Bug | ==== Bug description ==== | ||
TO ADD DESCRIPTION OF EACH ONE OF THE 5 BUGS: | |||
* #1 com.sony.gemstack.org.dvb.user.UserPreferenceManagerImpl userprefs hijack leading to classes instantiation under privileged context (affecting ?PS3?, PS4, PS5) | |||
* #2 com.oracle.security.Service leading to privileged constructor call (affecting ?PS3?, PS4, not PS5) | |||
* #3 com.sony.gemstack.org.dvb.io.ixc.IxcProxy leading to privileged method call (affecting ?PS3?, PS4, PS5) | |||
* #4 JIT compiler hack leading to usermode arbitrary RW and arbitrary usermode code execution (affecting ?PS3?, PS4, not PS5) | |||
* #5 UDF buffer overflow kernel exploit (affecting ?PS3?, PS4, PS5) | |||
This exploit chain alone does not allow one to run pirated games on PS4 or PS5 as there is not enough RAM allowed in the BD-J process and there are other constraints. | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
Line 192: | Line 118: | ||
== Usermode Exploits (WebKit) == | == Usermode Exploits (WebKit) == | ||
=== | === FW 6.00-8.50-?.?? - FrameLoader::loadInSameDocument UaF (CVE-2022-22620) leading to crash === | ||
==== Credits ==== | ==== Credits ==== | ||
* Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2022-06-14) | * Maddie Stone, Google Project Zero, for sharing a write-up describing this vulnerability (2022-06-14) | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22620.html Short writeup by Maddie Stone (2022-06-14)] | * [https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2022/CVE-2022-22620.html Short writeup by Maddie Stone (2022-06-14)] | ||
* [https://googleprojectzero.blogspot.com/2022/06/an-autopsy-on-zombie-in-wild-0-day.html Detailed writeup by Maddie Stone (2022-06-14)] | * [https://googleprojectzero.blogspot.com/2022/06/an-autopsy-on-zombie-in-wild-0-day.html Detailed writeup by Maddie Stone (2022-06-14)] | ||
==== Bug | ==== Bug description ==== | ||
The | The bug is related to web browser history and is triggered only when pressing back button (O on PS4 controller), but requires many attempts. On vulnerable PS4 FW, after 3 or 4 attempts it gives OOM. A way to know if the system is vulnerable is the appearance of the input HTML element the PoC page after the timeout. | ||
A way to know if the system is vulnerable is the appearance of the input HTML element | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* | * See PoC in Maddie Stone's writeups. | ||
==== Patched ==== | ==== Patched ==== | ||
''' | '''Maybe''' on PS4 FW 9.60 and '''Maybe''' on PS5 FW 4.51. | ||
Tested working on PS4 FWs 6.00-8.50 and PS5 FWs none. Untested: every PS5 FWs. PS4 FWs <=5.56 seems invulnerable as the HTML input field stays blur (blue outline) after second timeout whilst it should not if the console were exploitable. | |||
Tested working on PS4 FWs 6.00- | |||
=== FW 9.00-9.04 - WebCore::CSSFontFaceSet vulnerabilities leading to arbitrary RW === | === FW 9.00-9.04 - WebCore::CSSFontFaceSet vulnerabilities leading to arbitrary RW === | ||
Line 389: | Line 159: | ||
* [https://github.com/WebKit/WebKit/commit/fbf37d27e313d8d0a150a74cc8fab956eb7f3c59 WebKit fix commit by Myles C. Maxfield merged by Russell Epstein (2021-09-09)] | * [https://github.com/WebKit/WebKit/commit/fbf37d27e313d8d0a150a74cc8fab956eb7f3c59 WebKit fix commit by Myles C. Maxfield merged by Russell Epstein (2021-09-09)] | ||
* [https://github.com/WebKit/WebKit/blob/74bd0da94fa1d31a115bc4ee0e3927d8b2ea571e/Source/WebCore/css/CSSFontFaceSet.cpp#L223 Part of vulnerable code] | * [https://github.com/WebKit/WebKit/blob/74bd0da94fa1d31a115bc4ee0e3927d8b2ea571e/Source/WebCore/css/CSSFontFaceSet.cpp#L223 Part of vulnerable code] | ||
* [https://web.archive.org/web/20211020134808/https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-30858.html (archive) Write-up and PoC by Maddie Stone (2021-10-13)]. Maddie Stone's vulnerability is not CVE-2021-30858 but | * [https://web.archive.org/web/20211020134808/https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2021/CVE-2021-30858.html (archive) Write-up and PoC by Maddie Stone (2021-10-13)]. Maddie Stone's vulnerability is not CVE-2021-30858 but was guessed to be by Maddie Stone. See [https://github.com/googleprojectzero/0days-in-the-wild/commit/65fcdf0473ada4e80dc967662ea8f3f3ce4ea81e#diff-1a428c43cedcf140e5bd6f92e4527f169c3c717780e1586f2fab589e4f467b52 write-up edit commit]. Warning: Maddie Stone's vulnerability was wrongly classified as a use-after-free by Maddie Stone according to sleirsgoevy. | ||
* [https://wololo.net/2021/10/14/use-after-free-webkit-vulnerability-impacts-ps4-possibly-up-to-firmware-9-00-included/ Vulnerability description by Wololo (2021-10-14)] | * [https://wololo.net/2021/10/14/use-after-free-webkit-vulnerability-impacts-ps4-possibly-up-to-firmware-9-00-included/ Vulnerability description by Wololo (2021-10-14)] | ||
==== Bug | ==== Bug description ==== | ||
Description in WebKit fix commit by Myles C. Maxfield: | Description in WebKit fix commit by Myles C. Maxfield: | ||
After r256659, asking for a failed CSSFontFace's families() returns nullopt. It | After r256659, asking for a failed CSSFontFace's families() returns nullopt. It's possible to add a failed font to a CSSFontFaceSet (of course). When we do that, we recognize the font is failed and don't update our internal data structures, because there's no need to - we can't do anything useful with a failed font. If you _then_ try to remove the font from the CSSFontFace, we don't call families(), but instead just pull out the raw m_families member, and look in our internal data structures for it, but we don't find it, because it was never added. | ||
Description in Maddie Stone's write-up: | Description in Maddie Stone's write-up: | ||
The vulnerability is a use-after-free due to an unchecked end() iterator. There was an assert statement: ASSERT(iterator != m_facesLookupTable.end());, but ASSERTs | The vulnerability is a use-after-free due to an unchecked end() iterator. There was an assert statement: ASSERT(iterator != m_facesLookupTable.end());, but ASSERTs don't do anything in release builds. Therefore, even if iterator == m_facesLookupTable.end() in the release build, nothing would happen and iterator would still be used. In FontFaceSet a FontFace is not added to the faces lookup table in addToFacesLookupTable if the font has already been deemed to be invalid. However, removeFromFacesLookupTable would still attempt to remove the font, leading to the use-after-free. The patch changes the ASSERT to an if clause. The function will return if iterator == m_facesLookupTable.end(), since the item it wishes to remove is not found in the table. | ||
Description by sleirsgoevy: | Description by sleirsgoevy: | ||
Line 407: | Line 178: | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [https://web.archive.org/web/20211024215236/http://vdsina.sleirsgoevy.dynv6.net:8081/ (archive) First exploit PoC for Safari by sleirsgoevy (2021-10-24)] | * [https://web.archive.org/web/20211024215236/http://vdsina.sleirsgoevy.dynv6.net:8081/ (archive) First exploit PoC for Safari by sleirsgoevy (2021-10-24)] | ||
* [https://gist.github.com/sleirsgoevy/6beca32893909095f4bba1ce29167992 First exploit PoC for PS4 FW 9.00-9.04 and PS5 FW 3.00-4. | * [https://gist.github.com/sleirsgoevy/6beca32893909095f4bba1ce29167992 First exploit PoC for PS4 FW 9.00-9.04 and PS5 FW 3.00-4.50 by sleirsgoevy (2021-10-27)] | ||
* [https://github.com/ChendoChap/pOOBs4/blob/main/webkit.js Implementation for PS4 FW 9.00 with exFAT kernel exploit in pOOBs4 by ChendoChap (2022-01-17)] | * [https://github.com/ChendoChap/pOOBs4/blob/main/webkit.js Implementation for PS4 FW 9.00 with exFAT kernel exploit in pOOBs4 by ChendoChap (2022-01-17)] | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' on PS4 FW 9.50 and '''No''' as of PS5 FW 4. | '''Yes''' on PS4 FW 9.50 and '''No''' as of PS5 FW 4.50. | ||
Might have been introduced in PS4 FW 3.50 and before PS5 FW 1.00 according to dates (need to check). However the vulnerability cannot be exploited in some conditions depending on how WebKit was compiled. For example, on PS4 FWs 7.55-8. | Might have been introduced in PS4 FW 3.50 and before PS5 FW 1.00 according to dates (need to check). However the vulnerability cannot be exploited in some conditions depending on how WebKit was compiled. For example, on PS4 FWs 7.55-8.53 and PS5 FWs <= 2.00, the FontFaceSet constructor returns with an exception that is propagated to JavaScript, preventing exploitation this way. | ||
Tested working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.50. Untested: PS5 FWs 2.10-2.50, 4.51. | |||
Tested working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4. | |||
=== FW 6.00-7.55 - WebCore::ValidationMessage::buildBubbleTree() UaF leading to arbitrary RW === | === FW 6.00-7.55 - WebCore::ValidationMessage::buildBubbleTree() UaF leading to arbitrary RW === | ||
Line 431: | Line 200: | ||
* [http://i.blackhat.com/eu-20/Thursday/eu-20-Meffre-This-Is-For-The-Pwners-Exploiting-A-Webkit-0day-In-Playstation4.pdf Presentation slides by by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)] | * [http://i.blackhat.com/eu-20/Thursday/eu-20-Meffre-This-Is-For-The-Pwners-Exploiting-A-Webkit-0day-In-Playstation4.pdf Presentation slides by by Quentin Meffre (@0xdagger) and Mehdi Talbi (@abu_y0ussef) (2020-12-10)] | ||
==== Bug | ==== Bug description ==== | ||
* The method buildBubbleTree makes a call to update the layout during which all user registered JS handlers are executed. If the ValidationMessage is destroyed in a JS callback, this could lead to a Use-After-Free situation when we get back to buildBubbleTree code. | * The method buildBubbleTree makes a call to update the layout during which all user registered JS handlers are executed. If the ValidationMessage is destroyed in a JS callback, this could lead to a Use-After-Free situation when we get back to buildBubbleTree code. | ||
Line 445: | Line 215: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 8.00 FW. | '''Yes''' in 8.00 FW. Tested working on FWs 6.00-7.55, not working on FWs <= 5.56. HTML textarea guessed addresses for FWs 6.70-7.55 are known but not for FWs 6.00-6.51 so an attacker needs to make tests to determine these addresses on FWs 6.00-6.51. | ||
Tested working on FWs 6.00-7.55, not working on FWs <= 5.56. HTML textarea guessed addresses for FWs 6.70-7.55 are known but not for FWs 6.00-6.51 so an attacker needs to make tests to determine these addresses on FWs 6.00-6.51. | |||
=== FW 6.00-6.72 - bad_hoist Type Confusion exploit (CVE-2018-4386) leading to arbirary RW === | === FW 6.00-6.72 - bad_hoist Type Confusion exploit (CVE-2018-4386) leading to arbirary RW === | ||
Line 465: | Line 231: | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary | WebKit: JSC: BytecodeGenerator::hoistSloppyModeFunctionIfNecessary doesn't invalidate the ForInContext object. | ||
It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated. | It is possible to craft Javascript in such a way that allows for an object to be passed as the property variable directly as a string to the op_get_direct_pname handler without being properly validated. | ||
Line 492: | Line 258: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 7.00 FW. | '''Yes''' in 7.00 FW. Vulnerable on PS4 FWs 4.50-6.72. Not vulnerable on FWs <= 4.07. Not vulnerable on FWs >=7.00 according to manual tests but need to check WebKit sources. | ||
Vulnerable on PS4 FWs 4.50-6.72. Not vulnerable on FWs <= 4.07. Not vulnerable on FWs >=7.00 according to manual tests but need to check WebKit sources. | |||
---- | ---- | ||
Line 518: | Line 281: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 6.50 FW. | '''Yes''' in 6.50 FW. It does not work on <= 4.07 FW PS4 according to tests as the exploit fails at step "Triggering memory corruption". | ||
It does not work on <= 4.07 FW PS4 according to tests as the exploit fails at step "Triggering memory corruption". | |||
---- | ---- | ||
Line 661: | Line 421: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3.15-4.07. Not working on <= 3.11 | Works on 3.15-4.07. Not working on <=3.11. | ||
---- | ---- | ||
Line 719: | Line 432: | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://blog.xyz.is/2016/webkit-360.html PSVita 3.60 | * [https://blog.xyz.is/2016/webkit-360.html PSVita 3.60 HENKaku WebKit exploit writeup] | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer | When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer isn't re-updated nor nulled. When this memory in free()'d, the reference is maintained and thus memory corruption can occur. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
Line 737: | Line 450: | ||
=== FW <= 3.50 - WebCore::TimerBase::heapPopMin() Heap UaF leading to crash === | === FW <= 3.50 - WebCore::TimerBase::heapPopMin() Heap UaF leading to crash === | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://github.com/WebKit/WebKit-http/commit/98845d940e30529098eea7e496af02e14301c704 WebKit fix commit ( | * [https://github.com/WebKit/WebKit-http/commit/98845d940e30529098eea7e496af02e14301c704 WebKit fix commit (17-05-2016)] | ||
* [https://xz.aliyun.com/t/292 Summary of Critical and Exploitable iOS Vulnerabilities in 2016 by Min (Spark) Zheng, Cererdlong, Eakerqiu @ Team OverSky] | * [https://xz.aliyun.com/t/292 Summary of Critical and Exploitable iOS Vulnerabilities in 2016 by Min (Spark) Zheng, Cererdlong, Eakerqiu @ Team OverSky] | ||
Line 749: | Line 459: | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [http://psxhax.com/threads/ps4-3-50-webkit-exploit-from-playstation-4-dev-qwertyoruiop.450/ Article about qwertyoruiop's tests ( | * [http://psxhax.com/threads/ps4-3-50-webkit-exploit-from-playstation-4-dev-qwertyoruiop.450/ Article about qwertyoruiop's tests (20-05-2016)] | ||
* [http://psxhax.com/threads/ps4-heap-use-after-free-at-webcore-3-50-poc-by-hunter128.452/ Article about initial PoC for PS4 ( | * [http://psxhax.com/threads/ps4-heap-use-after-free-at-webcore-3-50-poc-by-hunter128.452/ Article about initial PoC for PS4 (21-05-2016)] | ||
* [http://wololo.net/talk/viewtopic.php?t=45888 Initial PoC for PS4 ( | * [http://wololo.net/talk/viewtopic.php?t=45888 Initial PoC for PS4 (21-05-2016)] | ||
* [https://web.archive.org/web/20161030085033/http://cryptoanarchic.me/wat.txt iOS 9.3.2 WebKit RCE via heapPopMin (2016 | * [https://web.archive.org/web/20161030085033/http://cryptoanarchic.me/wat.txt iOS 9.3.2 WebKit RCE via heapPopMin (07-2016)] | ||
* [https://twitter.com/qwertyoruiopz/status/756268361282125824 qwertyoruiop's tweet ( | * [https://twitter.com/qwertyoruiopz/status/756268361282125824 qwertyoruiop's tweet (22-07-2016)] | ||
* [https://github.com/Jailbreaks/jbme/tree/master mirror of iOS 9.3.2 WebKit RCE via heapPopMin] | * [https://github.com/Jailbreaks/jbme/tree/master mirror of iOS 9.3.2 WebKit RCE via heapPopMin] | ||
Line 761: | Line 471: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3.15, 3.50 FW. Maybe working on 3.51 FW. | Works on 3.15, 3.50 FW. Maybe working on 3.51 FW. | ||
---- | ---- | ||
Line 862: | Line 546: | ||
* Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013) | * Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013) | ||
* nas and Proxima for the first PS4 POC on 1.76 PS4 ( | * nas and Proxima for the first PS4 POC on 1.76 PS4 (Oct. 23, 2014) | ||
* sony for patching the exploit in FW 2.00 ( | * sony for patching the exploit in FW 2.00 (Oct 27, 2014) | ||
* CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849] | * CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849] | ||
Line 887: | Line 571: | ||
==== Tested ==== | ==== Tested ==== | ||
* Working on | * Working on 1.00-1.76 FW, AppleWebKit/531.3-536.26 | ||
* Might work on | * Might work on FW 0.930.020. | ||
== Usermode securities == | == Usermode securities == | ||
Line 925: | Line 578: | ||
=== Usermode ASLR === | === Usermode ASLR === | ||
* Very old firmwares (<= 1.05) | * Very old firmwares (<= 1.05) don't have ASLR enabled, but it was introduced sometime before firmware 1.70. "Address Space Layout Randomization" (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4. | ||
* To defeat usermode ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address. | * To defeat usermode ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address. | ||
=== Module imports table cleaned before execution === | === Module imports table cleaned before execution === | ||
* Between 1.76 and 4.05, Sony did that to prevent | * Between 1.76 and 4.05, Sony did that to prevent webkit exploiters from defeating usermode ASLR easily. | ||
* Now we have to dump entire usermode sandboxed memory, and by studying it we can defeat ASLR: | * Now we have to dump entire usermode sandboxed memory, and by studying it we can defeat ASLR: | ||
1. Chose a function (ex: __stack_chk_fail) imported from | 1. Chose a function (ex: __stack_chk_fail) imported from LibKernel by SceWebkit2 | ||
2. Read pointer contained at the address where the call is done | 2. Read pointer contained at the address where the call is done | ||
3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | 3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | ||
4. This result is LibKernel base address. This method works for any imported module. | 4. This result is LibKernel base address. This method works for any imported module. | ||
=== DEP / NX === | === DEP / NX === | ||
* "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to usermode memory then executing it. | * "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to usermode memory then executing it. | ||
* 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs). | * 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs). | ||
=== JiT removed from webbrowser === | === JiT removed from webbrowser === | ||
* On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | * On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | ||
* Workaround is to use ROP. | * Workaround is to use ROP. | ||
=== Syscalls removed === | === Syscalls removed === | ||
=== Syscall 0 disabled i.e Error Kernel: The application directly issues a syscall instruction (24) === | |||
* Between 2.00 and 2.57, SCE has removed system call 0, so we can no longer call any syscall we want by specifying the call number in the rax register. | |||
* Doing so now crashes the app and gives error CE-34878-0, SCE_KERNEL_ABORT_REASON_SYSTEM_ILLEGAL_FUNCTION_CALL, with the message "Kernel: The application directly issues a syscall instruction (24)". | |||
Between 2.00 and 2.57, SCE has | * We now have to use wrappers provided to us from the libkernel / libkernel_web / libkernel_sys modules to access system calls. | ||
* | |||
=== bpf_write function stripped out of the kernel === | === bpf_write function stripped out of the kernel === | ||
Line 975: | Line 611: | ||
=== bpf_open function blocked for unprivileged processes === | === bpf_open function blocked for unprivileged processes === | ||
* On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF. | * On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking BPF kernel exploits especially qwertyoruiop's BPF double free UAF. | ||
=== bpf_ioctl function blocked or removed === | === bpf_ioctl function blocked or removed === | ||
* Moreover, on FW 5.50+, opening BPF is still possible in less sandboxed apps like test/devkits fselfs. But this is useless because ioctl doesn't work. | |||
* | |||
=== Device access blocked/removed from webbrowser === | === Device access blocked/removed from webbrowser === | ||
* Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from | * Around 6.50-6.70, device access got blocked or removed. Now you can no longer access devices from webbrowser | ||
== Kernel Exploits == | |||
== | |||
=== FW <= 9.00 - PPPoE driver remote buffer overflow (CVE-2022-29867) === | === FW <= 9.00 - PPPoE driver remote buffer overflow (CVE-2022-29867) === | ||
Line 1,167: | Line 736: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in PS4 9.03 FW and PS5 4.50 FW | '''Yes''' in PS4 9.03 FW and PS5 4.50 FW. | ||
---- | ---- | ||
Line 1,243: | Line 812: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in PS4 7.50 FW and in PS5 5.00 or 5.02 FW. Not working in PS5 FWs <= 2. | '''Yes''' in PS4 7.50 FW and in PS5 5.00 or 5.02 FW. Not working in PS5 FWs <= 2.50. | ||
---- | ---- | ||
Line 1,319: | Line 888: | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the | * [https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's writeup on the 1.01-4.05 namedobj kernel exploit] (2017-10-19) | ||
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20) | * [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/NamedObj%20Kernel%20Exploit%20Overview.md Specter's first writeup] (2017-10-20) | ||
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his | * [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's writeup on his 4.05 implementation] (2017-12-28) | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
Line 1,329: | Line 896: | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit] | |||
==== Patched ==== | ==== Patched ==== | ||
Line 1,335: | Line 902: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on FWs 4.00-4.05. On <= 3.70 FW we | Works on FWs 4.00-4.05. On <=3.70 FW we haven't found a way to leak the target object, but it might be doable as F0F did it on 1.01. | ||
---- | ---- | ||
Line 1,444: | Line 957: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 2.00 FW | '''Yes''' in 2.00 FW | ||
=== FW ??? - setlogin Information Leak (CVE-2014-8476) === | === FW ??? - setlogin Information Leak (CVE-2014-8476) === | ||
Line 1,472: | Line 984: | ||
==== Patched ==== | ==== Patched ==== | ||
? | |||
== Kernel securities == | == Kernel securities == | ||
Line 1,499: | Line 1,001: | ||
* [https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c398342ed6499a00fce0c081f7bf1efaaef1/kernel.js Detailed annotation of the PS4 5.05 kernel exploit by Specter] | * [https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c398342ed6499a00fce0c081f7bf1efaaef1/kernel.js Detailed annotation of the PS4 5.05 kernel exploit by Specter] | ||
* [[ | * Zero2Ring0 Slides by qwertyoruiop [[File:02r0.pdf|Zero2Ring0 Slides by qwertyoruiop]] ([https://web.archive.org/web/20210116214117/http://crack.bargains/02r0.pdf Archive]) | ||
* [https://web.archive.org/web/20120512144251/https://marcoramilli.blogspot.com/2011/12/from-rop-to-jop.html From ROP to JOP article by Marco Ramilli] | * [https://web.archive.org/web/20120512144251/https://marcoramilli.blogspot.com/2011/12/from-rop-to-jop.html From ROP to JOP article by Marco Ramilli] | ||
Line 1,508: | Line 1,010: | ||
* [https://github.com/sleirsgoevy/ps4jb/blob/master/src/oldkex.c#L451 cli/sti SMAP bypass in 6.72 PS4 kernel exploit] | * [https://github.com/sleirsgoevy/ps4jb/blob/master/src/oldkex.c#L451 cli/sti SMAP bypass in 6.72 PS4 kernel exploit] | ||
==== | ==== SMAP bypass method: CVE-2021-29628 ==== | ||
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched on PS5 FW 2.30 or later according to dates. | |||
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd] | |||
* [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd] | |||
=== CR0.WP protection === | === CR0.WP protection === | ||
At least since | At least since firmware 6.51 Sony instrumented all instructions that write to the CR0 register with checks for attempts to clear CR0.WP (Write Protect), which is necessary for patching the kernel. This is what it looks like in 6.51 kernel: | ||
a1b79: 0f 22 c0 mov cr0,rax | a1b79: 0f 22 c0 mov cr0,rax | ||
Line 1,525: | Line 1,030: | ||
Bypasses (in chronological order): | Bypasses (in chronological order): | ||
* Use an "unintended" mov to cr0 in the middle of another instruction (e.g. instruction "call $+0x220f1c" (e8 17 0f 22 00) contains an unintended "mov cr0, rax" (0f 22 00)) | |||
* Use kernel write to give your process JIT permissions, allocate JIT memory, and put entirely custom code there (avoids the problem altogether, as it is specific to ROP) | |||
* Since the IDT is writable on FreeBSD and PS4, it is possible to overwrite an exception handler without clearing CR0.WP first. One can overwrite the handler of #UD with a gadget of their choice (a stack pivot, or a "add rsp, ... ; ret", or whatever else), and the UD2 instruction in the mitigation code will happily jump to it instead of the real handler, with CR0.WP cleared. | |||
* | |||
* | |||
{{Reverse Engineering}} | {{Reverse Engineering}} | ||
<noinclude> | <noinclude>[[Category:Main]]</noinclude> | ||
[[Category:Main]] | |||
</noinclude> |