Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
| Latest revision | Your text | ||
| Line 27: | Line 27: | ||
== WebKit exploits == | == WebKit exploits == | ||
=== Modal Browser HTTPS Bypass === | === Modal Browser HTTPS Bypass === | ||
| Line 49: | Line 47: | ||
Tested and working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60. | Tested and working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60. | ||
=== FW 6.00-8.60 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW === | === FW 6.00-8.60 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW === | ||
| Line 125: | Line 73: | ||
=== FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution === | === FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution === | ||
Contrarly to PS4, on PS5 this exploit does not allow arbitrary usermode memory RW because of PS5 memory protections. However thanks to tricks it is possible to get usermode ROP code execution from this exploit. | |||
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_9.00-9.04_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW]. | See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_9.00-9.04_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW]. | ||
| Line 130: | Line 80: | ||
==== Implementations ==== | ==== Implementations ==== | ||
* [https://github.com/ChendoChap/PS5-Webkit-Execution Implementation for PS5 | * [https://github.com/ChendoChap/PS5-Webkit-Execution Implementation for PS5 by ChendoChap] | ||
==== Patched ==== | ==== Patched ==== | ||
'''No''' as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00) | '''No''' as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00). | ||
==== Tested ==== | ==== Tested ==== | ||
Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2. | Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00. | ||
== Game savedata exploits == | == Game savedata exploits == | ||
| Line 176: | Line 125: | ||
= Kernel = | = Kernel = | ||
== Physical memory readable by kernel (Meme Dumper) == | == Physical memory readable by kernel (Meme Dumper) == | ||
| Line 298: | Line 233: | ||
* See also implementation for FreeBSD 9 or 12 or PS4. | * See also implementation for FreeBSD 9 or 12 or PS4. | ||
* [https://github.com/Cryptogenic/PS5- | * [https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Kernel exploit implementation for PS5 3.00-4.51 by Specter (2022-10-02)] | ||
=== Patched === | === Patched === | ||
'''Yes''' in PS5 FW 5.00. Invulnerable in PS5 FW 2. | '''Yes''' in PS5 FW 5.00. Invulnerable in PS5 FW 2.50 and below. | ||
---- | ---- | ||
| Line 316: | Line 250: | ||
=== Exploit Implementation === | === Exploit Implementation === | ||
Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic. | |||
Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel | |||
=== Patched === | === Patched === | ||
| Line 371: | Line 303: | ||
Potentially vulnerable on PS5 FWs <= 4.03. | Potentially vulnerable on PS5 FWs <= 4.03. | ||
= | = Secure Loader = | ||
== Symmetric PS5 root keys dump by software exploit by Fail0verflow == | |||
See [https://twitter.com/fail0verflow/status/1457526453105569793 Fail0verflow's announcement on Twitter (2021-11-08)] | |||
Fail0verflow either has a bootrom execution exploit or an AMD/ARM PSP hack. | |||
''It is speculated that this exploit is a derivative of the ZenBleed [https://nvd.nist.gov/vuln/detail/CVE-2023-20593 CVE-2023-20593] exploit, as the PS5 APU is a custom ZEN 2 Ryzen chip.'' | |||
This allows to decrypt on PC most parts of the PS5 System Software files including: | |||
* PUP | |||
* secure loader (?AMD? ARM Platform Security Processor module) of Oberon | |||
And by derivation, mostly like on PS Vita: | |||
* secure modules | |||
* kernel boot loader / BIOS | |||
* non-secure kernel | |||
* usermode system modules | |||
Potentially unpatched. | |||
= | = Hypervisor = | ||
== <= ?10.01? - APIC pointers in kernel data segment == | |||
== <=? | |||
* Discovered by flatz. Disclosed publicly by flatz (2024-10-09). | * Discovered by flatz. Disclosed publicly by flatz (2024-10-09). | ||
The apic_ops structure is located in the PS5 kernel .data segment which has RW permissions. Using a kernel vulnerability, you can overwrite a function pointer inside the apic_ops structure, like xapic_mode. This allows to launch a ROP chain but one has to bypass the CFI protection. After doing a PS5 suspend/resume cycle, the ROP code will be executed before Hypervisor restarts. The ROP chain can apply patches in kernel .text section. | The apic_ops structure is located in the PS5 kernel .data segment which has RW permissions. Using a kernel vulnerability, you can overwrite a function pointer inside the apic_ops structure, like xapic_mode. This allows to launch a ROP chain but one has to bypass the CFI protection. After doing a PS5 suspend/resume cycle, the ROP code will be executed before Hypervisor restarts. The ROP chain can apply patches in kernel .text section. | ||
| Line 401: | Line 334: | ||
* [https://twitter.com/flat_z/status/1843966331093438891 flatz explanation on twitter (2024-10-09)] | * [https://twitter.com/flat_z/status/1843966331093438891 flatz explanation on twitter (2024-10-09)] | ||
* Maybe unpatched as of PS5 FW 10.01. | |||
== <=4.51 - Hypervisor bypass vulnerability == | |||
* Discovered by anonymous (probably fail0verflow or TheFloW). Announced by Flatz (2024-10-05). | |||
* Patched since PS5 FW 5.00. | |||
* | |||
== <=2.50 - Hypervisor vulnerability leading to compromise and XOM bypass == | |||
* Discovered by Specter (2023-07-01) and Flatz (before 2023-07-27). | |||
* Exploited privately by Specter and ChendoChap (2024-09-29). | |||
* Will be disclosed publicly at Hardwear.io 2024 conference (2024-10-24). | |||
* Patched since PS5 FW 3.00. | |||
== <=2.50 - Hypervisor integrated as part of the kernel binary == | |||
* Discovered by Specter (2023-07-01) and Flatz (before 2023-07-27). | |||
* Exploited privately by Specter and ChendoChap (2024-09-29). | |||
* This makes Hypervisor exploitation easier as it can be triggered by usermode directly without the need of a kernel exploit. | |||
* See [[Hypervisor#In-Kernel_Hypervisor_.28.3C.3D_2.50.29]] and [https://wololo.net/2023/07/02/ps5-specterdev-shares-details-on-in-kernel-hypervisor-earlier-versions-of-the-ps5-hypervisor-found-in-firmwares/ wololo article (2023-07-02)]. | |||
* This also allows to dump kernel .text segment once one has code execution in hypervisor. See [https://x.com/SpecterDev/status/1840303332763512837 Specter's tweet about PS5 kernel .text dump]. | |||
* Patched since PS5 FW 3.00. | |||
= Platform Secure Processor = | |||
=== | == <=2.50 - PSP dump via Hypervisor exploit == | ||
* Discovered by Fail0verflow before 2023-07-27, discovered independently and announced on 2023-07-27 by flatz ([https://twitter.com/flat_z/status/1684554194366107650 Announcement by flatz (2023-07-27)]). | |||
* Thanks to this software exploit, flatz got access to most PS5 decryption keys. | |||
* See also [https://www.psxhax.com/threads/flat_z-confirms-ps5-hypervisor-exploitation-from-ps4-save-game.16063/ flatz's comments]. | |||
* | * Vulnerable on PS5 FWs <= 2.50 and potentially patched since 3.00. | ||
= Southbridge = | = Southbridge = | ||
| Line 566: | Line 379: | ||
== EMC, EFC and EAP vulnerabilities leading to code execution == | == EMC, EFC and EAP vulnerabilities leading to code execution == | ||
Credits: | |||
* Disclosed by Shawn Hoffman (of SYMBRKRS LLC, @shuffle2 of fail0verflow) at the Security Analyst Summit Conference 2024 (2024-10-23). | * Disclosed by Shawn Hoffman (of SYMBRKRS LLC, @shuffle2 of fail0verflow) at the Security Analyst Summit Conference 2024 (2024-10-23). | ||
Bug description: | |||
Exploits allowing code execution on EMC, EFC and EAP have been detailed, along with release of a tool which implements the exploits. The process of initial exploration/discovery is also be briefly covered. From a security researcher point of view, the exploits are interesting as they cover a hard-to-spot bug in a firmware state machine, and abusing hardware misconfiguration to bypass memory protection measures. The exploits/tooling allow for further research into the system. | |||
It is required to solder to [[Service Connectors]] to make use of these vulnerabilities. | It is required to solder to [[Service Connectors]] to make use of these vulnerabilities. | ||
Analysis: | |||
* https://symbrkrs.com/presentations/Beyond_Oberon-SAS2024.pdf | |||
* | Implementation: | ||
* https://github.com/symbrkrs/ps5-uart | |||
== | = Unclassified = | ||
== TheFloW's neither usermode nor kernel exploit == | |||
* On 2024-08-29, TheFloW received 10.000$ from Sony for disclosing privately on Sony's HackerOne bug bounty program a vulnerability. | |||
* According to Flatz, this vulnerability affects neither usermode nor kernel, so it might be either about hardware or more likely about Hypervisor. | |||
* This vulnerability probably got patched in PS5 FW 10.00 or in PS5 FW 9.60, or if it is not patchable by software, is patched in new hardware revisions of the PS5. | |||
= Hardware = | |||
== Untested: ZenBleed (''[https://nvd.nist.gov/vuln/detail/CVE-2023-20593 CVE-2023-20593]) leak register contents directly from the CPU.'' == | |||
This is a well documented CPU vulnerability in AMD Processors with the Zen 2 microarchitecture. There is no proof of concept specifically for the PS5, however we do know the PS5 uses a custom Zen 2 chip. This is a hardware bug that uses software to exploit the system. AMD has since patched this with [https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html software], but we are unsure of the status for the latest PS5 firmware (assumed to be patched). For more information see [[PS-Chi]]. | |||