Editing Bugs

The PS5 has bugs. Some bugs can lead to [[Vulnerabilities]]. Others lead to nothing useful (yet) but can serve as examples of what not to do.

= WebKit =

== Untested ==

=== Untested - mmap issue involving pointer address misalignment leading to nothing for now ===

==== Credits ====

* Jasmine, working for Sony, for information through a WebKit commit (2022-10-19)

==== Analysis ====

* https://bugs.webkit.org/show_bug.cgi?id=246763

==== Bug Description ====

There is a mmap issue involving pointer address misalignment because of a failing assert [https://github.com/WebKit/WebKit/blob/main/Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.cpp#L94 here]. A workaround is to set HAVE_MAP_ALIGNED flag as OFF in OptionsPlayStation.cmake: [https://github.com/WebKit/WebKit/commit/626585db9857b7630cf34d82f9a0555720f15bca]. This workaround can be reverted after the mmap issue is resolved. Currently, the workaround is still enabled: [https://github.com/WebKit/WebKit/blob/ab2fff92b37e52d6c65e215b155e6b92f1646954/Source/cmake/OptionsPlayStation.cmake#L251]

OptionsPlayStation.cmake is present in the PS4 11.00 OSS WebKit source code but does not contain the HAVE_MAP_ALIGNED flag, and according to dates, this might concern only the PS5.

==== Exploit Implementation ====

==== Patched ====

'''Maybe'''

==== Tested ====

Not tested yet on PS4 nor PS5.

== JIT disabled ==

=== FW ?6.00-9.60? - Immediate overflow/underflow in JSC SBFX (CVE-2024-27833) leading to arbitrary code execution ===

See also [https://www.psdevwiki.com/ps4/Bugs#FW_?10.00-11.52?_-_Immediate_overflow/underflow_in_JSC_SBFX_(CVE-2024-27833)_leading_to_arbitrary_code_execution].

=== FW ?6.00-8.60? - JSC::DFG::clobberize() needs to be more precise with the *ByOffset nodes (CVE-2023-41993) leading to arbitrary RW ===

See also [https://www.psdevwiki.com/ps4/Bugs#FW_?10.00-11.02?_-_JSC::DFG::clobberize()_needs_to_be_more_precise_with_the_*ByOffset_nodes_(CVE-2023-41993)_leading_to_arbitrary_RW].

=== FW 6.00-8.60 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW ===

See also [https://www.psdevwiki.com/ps4/Bugs#FW_10.00-11.02_-_JSC_DFG_Abstract_Intepreter_clobberWorld_Type_Confusion_(no_CVE)_leading_to_arbitrary_RW].

== Memory exhausted but not corrupted ==

=== FW 6.00-9.60 - Unknown heap and string overflow (no CVE) leading to crash ===

See also [https://www.psdevwiki.com/ps4/Bugs#FW_?10.00?-11.52_-_Unknown_heap_and_string_overflow_(no_CVE)_leading_to_crash].

==== Patched ====

'''Yes''' on PS4 FW 12.00 and PS5 FW 10.00.

==== Tested ====

Tested and working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.