Vulnerabilities: Difference between revisions
CelesteBlue (talk | contribs) |
CelesteBlue (talk | contribs) |
||
| Line 73: | Line 73: | ||
---- | ---- | ||
=== | == Userland securities == | ||
=== Userland ASLR === | |||
* Very old firmwares (<= 1.05) don't have ASLR enabled, but it was introduced sometime before firmware 1.70. "Address Space Layout Randomization" (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4. | |||
* To defeat userland ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address. | |||
=== Module imports table cleaned before execution === | |||
* Between 1.76 and 4.05, Sony did that to prevent webkit exploiters from defeating ASLR easily. | |||
* Now we have to dump entire userland memory, and we can defeat ASLR by: | |||
1) Chose a function (ex: __stack_chk_fail) imported from LibKernel by SceWebkit2 | |||
2) Read pointer contained at the address where the call is done | |||
3) Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | |||
4) This result is LibKernel base address. This method works for any imported module. | |||
=== JIT removed === | |||
* On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | * On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | ||
* Workaround is to use ROP. | |||
=== Syscalls removed === | |||
==== Syscall 0 disabled ==== | |||
* Between 1.76 and 4.05, Sony has removed system call 0, so we can no longer call any system call we like by specifying the call number in the rax register. | |||
* We will have to use wrappers from the libkernel.sprx module provided to us to access system calls. | |||
=== bpf_write function stripped out of the kernel === | |||
* On 4.70, bpfwrite() was stripped out of the kernel entirely to patch kernel vulnerability exploited in 4.55 kexploit. | |||
=== bpf_open function blocked for unprivileged processes === | |||
* On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking bpf exploits like the 4.55 and 5.05 kexploit. | |||
== Kernel Exploits == | == Kernel Exploits == | ||
Revision as of 18:08, 29 August 2018
WebKit/Userland Exploits
FW <= 5.50 - haveABadTime Type Confusion
Analysis
Bug Description
When JSGlobalObject::haveABadTime() is called with arrays of a different JSGlobalObject type, type confusion can occur, leading to memory corruption.
Exploit Implementation
Patched
Yes in 5.53 FW
FW <= 5.05 - setAttributeNodeNS Use-After-Free (UAF)
Analysis
Specter's setAttributeNodeNS Exploit Writeup
Bug Description
By forcing setAttributeInternal() to call setAttributeNodeNS() twice, an attribute node reference will be added twice to the list. When one is free()'d, the second attribute still contains a duplicate stale reference, leading to a use-after-free (UAF) scenario.
Exploit Implementation
PS4 5.05 WebKit + Kernel Exploit
Patched
Yes in 5.50 FW
FW <= 4.07 - Stack Uninitialized Read
Analysis
Specter's 4.0x WebKit Exploit Writeup
Bug Description
Via a specially crafted valueOf() function of an arguments.length() function, non-zero indexes of the stack-allocated array are not initialized, leading to a stack uninitialized read. This can be abused to store a reference that can later be re-obtained post-GC (garbage collection) yielding a use-after-free() (UAF) situation.
Exploit Implementation
Patched
Yes in 4.50 FW
Tested
Works on 3.50.
FW <= 3.70 - JSArray.sort() Use-After-Free (UAF)
Analysis
PSVita HENKaku 3.60 webkit exploit writeup
Bug Description
When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer isn't re-updated nor nulled. When this memory in free()'d, the reference is maintained and thus memory corruption can occur.
Exploit Implementation
PSVita HENkaku by Molecule PS4 Playground 3.15-3.70 by Fire30
Patched
Yes in 4.00 FW
Tested
3.15, 3.50, 3.51, 3.55, 3.70
FW <= 2.03 - CSSSelector Heap Overflow (CVE-2014-1303)
Analysis
BlackHat EU 2014 'WebKit Everywhere - Secure Or Not?' slides
Bug Description
By forcing addRule() to be called on a CSS Selector via window.getMatchedCSSRules(), a 1-bit OOB write can be achieved and leveraged to corrupt heap memory.
Exploit Implementation
Patched
Yes in 2.50 FW
Tested
- 2.03
FW <= 1.76 - JSArray.sort() Heap Overflow (CVE-2012-3748)
Analysis
Exploit PoC by Vitaliy Toropov
Bug Description
By forcing the compare function to reduce the size of the array, trailing items will be written out of bounds (OOB write), leading to heap memory corruption.
Exploit Implementation
PSVita 2.60
PS4 playground 1.76 by CTurt
Patched
Yes in 2.00 FW
Userland securities
Userland ASLR
- Very old firmwares (<= 1.05) don't have ASLR enabled, but it was introduced sometime before firmware 1.70. "Address Space Layout Randomization" (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4.
- To defeat userland ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address.
Module imports table cleaned before execution
- Between 1.76 and 4.05, Sony did that to prevent webkit exploiters from defeating ASLR easily.
- Now we have to dump entire userland memory, and we can defeat ASLR by:
1) Chose a function (ex: __stack_chk_fail) imported from LibKernel by SceWebkit2 2) Read pointer contained at the address where the call is done 3) Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module 4) This result is LibKernel base address. This method works for any imported module.
JIT removed
- On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched.
- Workaround is to use ROP.
Syscalls removed
Syscall 0 disabled
- Between 1.76 and 4.05, Sony has removed system call 0, so we can no longer call any system call we like by specifying the call number in the rax register.
- We will have to use wrappers from the libkernel.sprx module provided to us to access system calls.
bpf_write function stripped out of the kernel
- On 4.70, bpfwrite() was stripped out of the kernel entirely to patch kernel vulnerability exploited in 4.55 kexploit.
bpf_open function blocked for unprivileged processes
- On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking bpf exploits like the 4.55 and 5.05 kexploit.
Kernel Exploits
FW <= 5.05 - BPF Race Condition (Yielding Double Free())
Analysis
Specter's Writeup of the 5.05 BPF Race Condition
Bug Description
Again due to improper locking, two threads can enter the BPF "SETWF" ioctl command handler. While the bug is similar to that of 4.55, the method of attack is slightly different. Since write() was removed for BPF in 4.70, instead of triggering a use-after-free with write() - "SETWF" is ran in parallel via threading. Eventually, both calls will copy the same pointer to the stack, leading to both threads free()'ing the same pointer, poisoning the freelist. This can later be leveraged via heap spraying to corrupt heap memory to obtain arbitrary code execution in supervisor mode (ring0).
Exploit Implementation
PS4 5.05 WebKit + Kernel Exploit
PS4 5.05 WebKit + Kernel Exploit Source
Patched
Yes in 5.50FW
FW <= 4.55 - BPF Race Condition (Yielding UaF)
Analysis
Specter's Writeup of the 4.55 BPF Race Condition
Bug Description
Due to improper locking, two threads can enter the BPF ioctl command handlers for setting a new write filter (SETWF) and setting a filter (SETIF). Both threads will reference the same pointer. In specially crafted situations, one thread could free() this pointer while the other thread executes it as a filter post-validation. This allows an unprivileged user to obtain an out-of-bounds (OOB) write on the stack, leading to arbitrary code execution in supervisor mode (ring0).
Exploit Implementation
PS4 4.55 WebKit + Kernel Exploit
PS4 4.55 WebKit + Kernel Exploit Source
Patched
Yes in 4.70FW
FW <= 4.05 - NamedObj Type Confusion (namedobj)
Analysis
fail0verflow's Writeup of the <= 4.05 Kernel Exploit
Specter's Writeup of 4.05 Implementation
Bug Description
Type confusion in the namedobj system once exploited can lead to an arbitrary free() allowing an attacker to craft a use-after-free() (UAF) situation to corrupt kernel memory. This can be leveraged to eventually obtain an arbitrary code execution primitive in supervisor mode (ring0).
Exploit Implementation
PS4 4.05 WebKit + Kernel Exploit
Patched
Yes in 4.06 FW
FW <= 1.76 - Dynamic Library Prepare Close (dlclose)
Analysis
Bug Description
Integer overflow in the sys_dynlib_prepare_dlclose() system call can lead to a heap overflow causing memory corruption, allowing an attacker to obtain code execution in supervisor mode (ring0).
Exploit Implementation
Patched
Yes in 2.00 FW
FW <= 1.76 - BadIRET
Analysis
Hacking the PS4, part 3 - Kernel exploitation (by CTurt)
NVD Bug Description
Bug Description
Faults associated with the stack segment (SS) register are not handled properly, allowing unprivileged users to trigger an IRET instruction that accesses a GS Base from userland memory, providing an attacker with a method of privilege escalation.
Source
Patched
Yes in 2.00 FW
Implementation
Kernel securities
Kernel ASLR
- At some point after the 1.76 FW, ASLR (Address Space Layout Randomization) was enabled in the kernel.
- This means that to properly exploit the kernel to escalate privileges, an information disclosure vulnerability will most likely be needed to defeat ASLR and locate the kernel in memory.
Kernel SMAP
- In 5.0x FW and above, "Supervisor Mode Access Prevention" (SMAP), a new custom mitigation was added to the kernel to prevent exploiters from pivoting the stack pointer into userland memory (attempting to do so will crash the system).
- A new exploitation strategy is needed for running kROP (kernel ROP) chains, such as qwertyoruiopz method used in the 5.05 BPF kernel exploit:
We need to get our ROP chain into kernel memory. To do this, qwertyoruiopz decided to go with the method he used on the iPhone 7 - essentially using JOP to push a bunch of stack frames onto the kernel stack, and memcpy()'ing the chain into RSP.
First Steps
VidNow
A possible exploit has been found in VidNow App in the Playstation Store App .
PATCHED: Sony has hotfixed this exploit via content hashing the file while in transit.
UPDATE: Some have managed to reverse the hotfix but the method is not known - the PS4 checks the content
hash HTTP header from the HMAC header.
SnagFilms
A possible exploit has been found in the SnagFilms App in the Playstation Store App.
Arbitrary code execution in memory has been demonstrated, although so far the system will throw an exception in the programs memory before the payload finishes loading.
If you craft a small enough payload and/or a payload that load's without causing an exception in program memory you can most likely get code execution working.
http://i.imgur.com/5OrSFCa.jpg
| |||||||||||||||||||||||||||||||||||||||||||||
