Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 28: | Line 28: | ||
== WebKit exploits == | == WebKit exploits == | ||
WebKit exploits are harder to make and do not even give arbitrary RW because of PS5 memory protections. | |||
=== Modal Browser HTTPS Bypass === | === Modal Browser HTTPS Bypass === | ||
* It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The | * It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want. | ||
==== Patched ==== | ==== Patched ==== | ||
Line 49: | Line 49: | ||
Tested and working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60. | Tested and working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60. | ||
=== FW 6.00-8.60 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW === | === FW 6.00-8.60 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW === | ||
Line 125: | Line 75: | ||
=== FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution === | === FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution === | ||
Contrarly to PS4, on PS5 this exploit does not allow arbitrary usermode memory RW because of PS5 memory protections. However thanks to tricks it is possible to get usermode ROP code execution from this exploit. | |||
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_9.00-9.04_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW]. | See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_9.00-9.04_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW]. | ||
Line 130: | Line 82: | ||
==== Implementations ==== | ==== Implementations ==== | ||
* [https://github.com/ChendoChap/PS5-Webkit-Execution Implementation for PS5 | * [https://github.com/ChendoChap/PS5-Webkit-Execution Implementation for PS5 by ChendoChap] | ||
==== Patched ==== | ==== Patched ==== | ||
'''No''' as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00) | '''No''' as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00). | ||
==== Tested ==== | ==== Tested ==== | ||
Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2. | Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00. | ||
== Game savedata exploits == | == Game savedata exploits == | ||
=== | === PS2 games savedata exploits === | ||
See [https://www.psdevwiki.com/ps4/Vulnerabilities# | See [https://www.psdevwiki.com/ps4/Vulnerabilities#Usermode_Exploits_.28Game_Savedata.29]. | ||
=== PS4/PS5 PS2emu sandbox escape (mast1c0re) === | === PS4/PS5 PS2emu sandbox escape (mast1c0re) === | ||
See [https://www.psdevwiki.com/ps4/Vulnerabilities#PS4.2FPS5_PS2emu_sandbox_escape_.28mast1c0re.29 | See [https://www.psdevwiki.com/ps4/Vulnerabilities#PS4.2FPS5_PS2emu_sandbox_escape_.28mast1c0re.29]. | ||
== PS4 emulator exploits == | == PS4 emulator exploits == | ||
Line 176: | Line 115: | ||
= Kernel = | = Kernel = | ||
== Physical memory readable by kernel (Meme Dumper) == | == Physical memory readable by kernel (Meme Dumper) == | ||
Line 226: | Line 151: | ||
* Synacktiv for finding and disclosing publicly the vulnerability (2024-09-04) | * Synacktiv for finding and disclosing publicly the vulnerability (2024-09-04) | ||
* Olivier Certner for fixing the bug (2024-09-04), kib for reviewing the bug fix (2024-09-04), Ed Maste for approving the bug fix commit (2024-09-04) | * Olivier Certner for fixing the bug (2024-09-04), kib for reviewing the bug fix (2024-09-04), Ed Maste for approving the bug fix commit (2024-09-04) | ||
* Shuffle from | * Shuffle from fail0verflow for the FreeBSD 11 and PS5 PoC in C++ (2024-09-14) | ||
* Flatz for writing a PS5 exploit chain with TheFloW's BD-JB2 (2024-09-14) | * Flatz for writing a PS5 exploit chain with TheFloW's BD-JB2 (2024-09-14) | ||
=== Analysis === | === Analysis === | ||
Line 237: | Line 161: | ||
* [https://securityonline.info/freebsd-issues-urgent-security-advisory-for-cve-2024-43102-cvss-10/ Vulnerability press release (2024-09-09)] | * [https://securityonline.info/freebsd-issues-urgent-security-advisory-for-cve-2024-43102-cvss-10/ Vulnerability press release (2024-09-09)] | ||
* [https://accessvector.net/2024/freebsd-umtx-privesc Writeup by [email protected] (2024-09-06)] | * [https://accessvector.net/2024/freebsd-umtx-privesc Writeup by [email protected] (2024-09-06)] | ||
=== Bug Description === | === Bug Description === | ||
Line 255: | Line 178: | ||
=== Exploit Implementation === | === Exploit Implementation === | ||
* [https://github.com/fail0verflow/ps5-umtxdbg/ C++ implementation for FreeBSD 11 | * [https://github.com/fail0verflow/ps5-umtxdbg/ C++ implementation for FreeBSD 11 and PS5 by Fail0verflow (2024-09-14)] | ||
* [https://gist.github.com/flatz/89dfe9ed662076742f770f92e95e12a7 JAVA implementation for PS5 | * [https://gist.github.com/flatz/89dfe9ed662076742f770f92e95e12a7 JAVA implementation part 1 for PS5 with BD-JB2 by Flatz (2024-09-14)] | ||
* [https://gist.github.com/flatz/5e12f75cdb210516d31df03069f7ed0a | * [https://gist.github.com/flatz/5e12f75cdb210516d31df03069f7ed0a JAVA implementation part 2 for PS5 with BD-JB2 by Flatz (2024-09-14)] | ||
=== Patched === | === Patched === | ||
Line 269: | Line 191: | ||
See the [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=_11.00_-_Remote_vulnerabilities_in_spp_(yielding_kernel_ASLR_defeat)_(CVE-2006-4304_and_no-CVE) PS4 wiki]. | See the [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=_11.00_-_Remote_vulnerabilities_in_spp_(yielding_kernel_ASLR_defeat)_(CVE-2006-4304_and_no-CVE) PS4 wiki]. | ||
Note that kernel ASLR defeat is currently not working on PS5 and there are protections remaining before being able to | Note that kernel ASLR defeat is currently not working on PS5 and there are protections remaining before being able to | ||
=== Patched === | === Patched === | ||
Line 298: | Line 220: | ||
* See also implementation for FreeBSD 9 or 12 or PS4. | * See also implementation for FreeBSD 9 or 12 or PS4. | ||
* [https://github.com/Cryptogenic/PS5- | * [https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Kernel exploit implementation for PS5 3.00-4.51 by Specter (2022-10-02)] | ||
=== Patched === | === Patched === | ||
'''Yes''' in PS5 FW 5.00. Invulnerable in PS5 FW 2. | '''Yes''' in PS5 FW 5.00. Invulnerable in PS5 FW 2.50 and below. | ||
---- | ---- | ||
Line 316: | Line 237: | ||
=== Exploit Implementation === | === Exploit Implementation === | ||
Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic. | |||
Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel | |||
=== Patched === | === Patched === | ||
Line 327: | Line 246: | ||
== SMAP bypass (CVE-2021-29628) == | == SMAP bypass (CVE-2021-29628) == | ||
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#Kernel_SMAP | See also [https://www.psdevwiki.com/ps4/Vulnerabilities#Kernel_SMAP]. | ||
=== Credits === | === Credits === | ||
Line 335: | Line 254: | ||
=== Analysis === | === Analysis === | ||
* [https:// | * [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd] | ||
* [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd] | |||
* [https:// | |||
=== Bug Description === | === Bug Description === | ||
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched. | |||
=== Patched === | === Patched === | ||
Line 348: | Line 265: | ||
'''Yes''' in PS5 FW 2.30 or later according to dates. | '''Yes''' in PS5 FW 2.30 or later according to dates. | ||
---- | ---- | ||
= Secure Kernel = | = Secure Kernel = | ||
Line 371: | Line 274: | ||
Potentially vulnerable on PS5 FWs <= 4.03. | Potentially vulnerable on PS5 FWs <= 4.03. | ||
= Secure Loader = | |||
= Secure Loader | |||
== Symmetric PS5 root keys dump by software exploit by Fail0verflow == | |||
See [https://twitter.com/fail0verflow/status/1457526453105569793 Fail0verflow's announcement on Twitter (2021-11-08)] | |||
Fail0verflow either has a bootrom execution exploit or an AMD/ARM PSP hack. | |||
''It is speculated that this exploit is a derivative of the ZenBleed [https://nvd.nist.gov/vuln/detail/CVE-2023-20593 CVE-2023-20593] exploit, as the PS5 APU is a custom ZEN 2 Ryzen chip.'' | |||
This allows to decrypt on PC most parts of the PS5 System Software files including: | |||
* PUP | |||
* secure loader (?AMD? ARM Platform Security Processor module) of Oberon | |||
And by derivation, mostly like on PS Vita: | |||
* secure modules | |||
* kernel boot loader / BIOS | |||
* non-secure kernel | |||
* usermode system modules | |||
Potentially unpatched. | |||
= | = Hardware = | ||
== Untested: ZenBleed (''[https://nvd.nist.gov/vuln/detail/CVE-2023-20593 CVE-2023-20593]) leak register contents directly from the CPU.'' == | |||
This is a well documented CPU vulnerability in AMD Processors with the Zen 2 microarchitecture. There is no proof of concept specifically for the PS5, however we do know the PS5 uses a custom Zen 2 chip. This is a hardware bug that uses software to exploit the system. AMD has since patched this with [https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html software], but we are unsure of the status for the latest PS5 firmware (assumed to be patched). For more information see [[PS-Chi]]. |