Editing Vulnerabilities

Jump to navigation Jump to search
Warning: You are not logged in. Your IP address will be publicly visible if you make any edits. If you log in or create an account, your edits will be attributed to your username, along with other benefits.

The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.

Latest revision Your text
Line 37: Line 37:


'''No''' as of PS5 FW 5.10.
'''No''' as of PS5 FW 5.10.
=== FW 6.00-9.60 - Unknown heap and string overflow (no CVE) leading to crash ===
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_?10.00?-11.52_-_Unknown_heap_and_string_overflow_(no_CVE)_leading_to_crash].
==== Patched ====
'''Yes''' on PS4 FW 12.00 and PS5 FW 10.00.
==== Tested ====
Tested and working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.


=== FW 6.00-8.60 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW ===
=== FW 6.00-8.60 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW ===
Line 62: Line 50:
Tested and working on PS4 FWs 10.00-11.02 and PS5 FWs 6.00-8.60.
Tested and working on PS4 FWs 10.00-11.02 and PS5 FWs 6.00-8.60.


=== FW <= 5.50 - FrameLoader::loadInSameDocument() UaF (CVE-2022-22620) leading to arbitrary RW ===
=== FW <= 5.50 - FrameLoader::loadInSameDocument UaF (CVE-2022-22620) leading to arbitrary RW ===


See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_6.00-9.60_-_FrameLoader::loadInSameDocument()_UaF_(CVE-2022-22620)_leading_to_arbitrary_RW].
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_6.00-9.60_-_FrameLoader::loadInSameDocument_UaF_(CVE-2022-22620)_leading_to_arbitrary_RW].


==== Patched ====
==== Patched ====


'''Yes''' on PS4 FW 10.00 and PS5 FW 6.00.
'''Yes''' on PS5 FW 6.00.


==== Tested ====
==== Tested ====
Line 94: Line 82:
== Game savedata exploits ==
== Game savedata exploits ==


=== PS2 game savedata exploits ===
=== PS2 games savedata exploits ===


See [https://www.psdevwiki.com/ps4/Vulnerabilities#PS2_games_savedata_exploits PS4 Dev Wiki].
See [https://www.psdevwiki.com/ps4/Vulnerabilities#Usermode_Exploits_.28Game_Savedata.29].


=== PS4/PS5 PS2emu sandbox escape (mast1c0re) ===
=== PS4/PS5 PS2emu sandbox escape (mast1c0re) ===


See [https://www.psdevwiki.com/ps4/Vulnerabilities#PS4.2FPS5_PS2emu_sandbox_escape_.28mast1c0re.29 PS4 Dev Wiki].
See [https://www.psdevwiki.com/ps4/Vulnerabilities#PS4.2FPS5_PS2emu_sandbox_escape_.28mast1c0re.29].
 
=== PS4/PS5 game savedata LUA exploit ===
 
See [https://www.psdevwiki.com/ps4/Vulnerabilities#PS4/PS5_game_savedata_LUA_exploit PS4 Dev Wiki].


== PS4 emulator exploits ==
== PS4 emulator exploits ==


Nothing yet.
Nothing yet.
== Usermode securities ==
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#Usermode_securities PS4 usermode securities].
=== >=8.00 - Syscalls and libkernel blocked from main usermode applications ===
Since PS5 System Software version 8.00, in order to make the PS5 less vulnerable to kernel escalation from usermode after TheFloW's disclose of BD-JB2, Sony blocked syscall and libkernel access from the main contenders such as BD JAVA, WebKit, PS2emu and probably more else all usermode applications.


= Kernel =
= Kernel =
Line 147: Line 123:
----
----


== FW <= 7.61 - umtx UaF (yielding arbitrary kernel R/W) (CVE-2024-43102) ==
== FW <= 8.20 - Remote vulnerabilities in spp (yielding kernel ASLR defeat) (CVE-2006-4304 and no-CVE) ==
 
=== Credits ===
 
* [email protected] for discovering the vulnerability, keeping it secret (2020-12) then sharing a writeup (2024-09-06)
* Rebecca Cran for discovering the bug in umtx (2023-05-07)
* Synacktiv for finding and disclosing publicly the vulnerability (2024-09-04)
* Olivier Certner for fixing the bug (2024-09-04), kib for reviewing the bug fix (2024-09-04), Ed Maste for approving the bug fix commit (2024-09-04)
* Shuffle from Fail0verflow for the FreeBSD 11 and PS5 PoC in C++ (2024-09-14)
* Flatz for writing a PS5 exploit chain with TheFloW's BD-JB2 (2024-09-14)
 
=== Analysis ===
 
* [https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=271300 Crash report by Rebecca Cran (2023-05-07)]
* [https://www.freebsd.org/security/advisories/FreeBSD-SA-24:14.umtx.asc FreeBSD Security Advisory for CVE-2024-43102 (2024-09-04)]
* [https://cgit.freebsd.org/src/commit/?id=62f40433ab47ad4a9694a22a0313d57661502ca1 Fix commit (2024-09-04)]
* [https://securityonline.info/freebsd-issues-urgent-security-advisory-for-cve-2024-43102-cvss-10/ Vulnerability press release (2024-09-09)]
* [https://accessvector.net/2024/freebsd-umtx-privesc Writeup by [email protected] (2024-09-06)]
 
=== Bug Description ===
 
The _umtx_op(2) system call provides support for the implementation of synchronization primitives between threads, and is used by the 1:1 Threading Library (libthr, -lthr) to implement IEEE Std 1003.1-2001 (POSIX.1-2001) pthread locks, like mutexes, condition variables and so on. In particular, its UMTX_OP_SHM operation provides support for anonymous shared memory associated to a particular physical address, which is used to implement process-shared mutexes (PTHREAD_PROCESS_SHARED).
 
Concurrent removals of such a mapping by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.
 
umtx_shm_unref_reg_locked() would unconditionally drop the "registry" reference, tied to USHMF_LINKED.
 
This is not a problem for caller umtx_shm_object_terminated(), which operates under the 'umtx_shm_lock' lock end-to-end, but it is for indirect caller umtx_shm(), which drops the lock between umtx_shm_find_reg() and the call to umtx_shm_unref_reg(true) that deregisters the umtx shared region (from 'umtx_shm_registry'; umtx_shm_find_reg() only finds registered shared mutexes).
 
Thus, two concurrent user-space callers of _umtx_op() with UMTX_OP_SHM and flags UMTX_SHM_DESTROY, both progressing past umtx_shm_find_reg() but before umtx_shm_unref_reg(true), would then decrease twice the reference count for the single reference standing for the shared mutex's registration.
 
A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.
 
=== Exploit Implementation ===
 
* [https://github.com/fail0verflow/ps5-umtxdbg/ C++ implementation for FreeBSD 11 virtual machine near of PS5 by Fail0verflow (2024-09-14)]
* [https://gist.github.com/flatz/89dfe9ed662076742f770f92e95e12a7 JAVA implementation for PS5 chained with BD-JB2 by Flatz (2024-09-14)]
* [https://gist.github.com/flatz/5e12f75cdb210516d31df03069f7ed0a LUA implementation for PS5 chained with LUA exploit by Flatz (2024-09-14)]
 
=== Patched ===
 
'''Yes''' in PS5 FW 8.00.
----
 
== FW <= 8.20 - Remote vulnerabilities in spp (yielding kernel panic) (CVE-2006-4304 and no-CVE) ==


See the [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=_11.00_-_Remote_vulnerabilities_in_spp_(yielding_kernel_ASLR_defeat)_(CVE-2006-4304_and_no-CVE) PS4 wiki].
See the [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=_11.00_-_Remote_vulnerabilities_in_spp_(yielding_kernel_ASLR_defeat)_(CVE-2006-4304_and_no-CVE) PS4 wiki].
Note that kernel ASLR defeat is currently not working on PS5 and there are protections remaining before being able to


=== Patched ===
=== Patched ===


'''Yes''' in PS5 FW 8.40.
'''Yes''' in PS5 FW 8.40.
----
== FW <= ?3.21? - PPPoE driver remote buffer overflow (CVE-2022-29867) ==
See the [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=_9.00_-_PPPoE_driver_remote_buffer_overflow_(CVE-2022-29867) PS4 wiki].
Note that PS5 is maybe not affected even though PS4 is.
=== Patched ===
'''Probably''' in PS5 FW 4.00.
----
----


Line 298: Line 217:


Potentially unpatched.
Potentially unpatched.
= Hypervisor =
== <=2.50 - Hypervisor integrated as part of the kernel binary ==
* Discovered by Specter (2023-07-01) and Flatz (before 2023-07-27).
* This makes Hypervisor exploitation easier as it can be triggered by usermode directly without the need of a kernel exploit.
* See [[Hypervisor#In-Kernel_Hypervisor_.28.3C.3D_2.50.29]] and [https://wololo.net/2023/07/02/ps5-specterdev-shares-details-on-in-kernel-hypervisor-earlier-versions-of-the-ps5-hypervisor-found-in-firmwares/ wololo article (2023-07-02)].
* Patched since PS5 FW 3.00.
= Platform Secure Processor =
== <=2.50 - PSP dump via Hypervisor exploit ==
* Discovered by Fail0verflow before 2023-07-27, discovered independently and announced on 2023-07-27 by flatz ([https://twitter.com/flat_z/status/1684554194366107650 Announcement by flatz (2023-07-27)]).
* Thanks to this software exploit, flatz got access to most PS5 decryption keys.
* See also [https://www.psxhax.com/threads/flat_z-confirms-ps5-hypervisor-exploitation-from-ps4-save-game.16063/ flatz's comments].
* Vulnerable on PS5 FWs <= 2.50 and potentially patched since 3.00.
= Unclassified =
== TheFloW's neither usermode nor kernel exploit ==
* On 2024-08-29, TheFloW received 10.000$ from Sony for disclosing privately on Sony's HackerOne bug bounty program a vulnerability.
* According to Flatz, this vulnerability affects neither usermode nor kernel, so it might be either about hardware or more likely about Hypervisor.
* This vulnerability probably got patched in PS5 FW 10.00 or in PS5 FW 9.60, or if it is not patchable by software, is patched in new hardware revisions of the PS5.


= Hardware =
= Hardware =


== Untested: ZenBleed (''[https://nvd.nist.gov/vuln/detail/CVE-2023-20593 CVE-2023-20593]) leak register contents directly from the CPU.'' ==
Nothing yet.
This is a well documented CPU vulnerability in AMD Processors with the Zen 2 microarchitecture. There is no proof of concept specifically for the PS5, however we do know the PS5 uses a custom Zen 2 chip. This is a hardware bug that uses software to exploit the system. AMD has since patched this with [https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html software], but we are unsure of the status for the latest PS5 firmware (assumed to be patched). For more information see [[PS-Chi]].
Please note that all contributions to PS5 Developer wiki are considered to be released under the GNU Free Documentation License 1.2 (see PS5 Developer wiki:Copyrights for details). If you do not want your writing to be edited mercilessly and redistributed at will, then do not submit it here.
You are also promising us that you wrote this yourself, or copied it from a public domain or similar free resource. Do not submit copyrighted work without permission!

To protect the wiki against automated edit spam, we kindly ask you to solve the following hCaptcha:

Cancel Editing help (opens in new window)
Retrieved from "http://www.psdevwiki.com/ps5/Vulnerabilities"