Exploit Chains

This page presents a compilation of exploit chains that utilize various Vulnerabilities identified on the PS5. It outlines the current functionalities of different potential and complete exploit chains for specific firmware versions.

System Software Version	Hardware requirement	Hypervisor Exploit	Kernel Exploit	Usermode Exploit	Exploit Chain Implementation	Capability
<=2.50	none	Rumored [1]	No need for a kernel exploit	any usermode exploit. Flatz uses a PS4 disc-based game save data exploit that hijacks the LUA interpreter.	Unreleased by Flatz	Full Access to the system, Platform Secure Processor dump
<=4.03	USB storage media	N/A	exFAT Driver Heap Exploit There is no implementation because of the difficulty in writing the exploit without a real-time kernel dump or at least kASLR defeat. The proof of concept is a kernel panic when plugging in the drive and using the console for about a minute.	any usermode exploit	N/A (PS4 uses pOOBs4 by ChendoChap)	N/A
3.00-4.51	none	N/A	IPV6_2292PKTOPTIONS UaF (CVE-2020-7457)	WebKit loadInSameDocument	need to mix Cryptogenic's Implementation and PsFree implementation by abc	Elf Loader
3.00-4.51	none	N/A	IPV6_2292PKTOPTIONS UaF (CVE-2020-7457)	WebKit CSSFontFaceSet	Cryptogenic's Implementation	Elf Loader
3.00-4.51	BD reader for PS5 + BD writer + BD-RE	N/A	IPV6_2292PKTOPTIONS UaF (CVE-2020-7457)	BD-JB	ps5-invoke-native by john-tornblom, bd-jb by TheFloW	Native code execution within Blu-ray context Here are some functions by john-tornblom
1.00-5.50	none	N/A	umtx UaF	WebKit loadInSameDocument	N/A (PsFree must be ported based on ChendoChap's implementation of the 4.51 CSSFontFaceSet exploit)	Elf Loader
6.00-7.61	none	N/A	umtx UaF	WebKit clobberWorld or unknown heap and string overflow	N/A (WebKit exploit only giving OOM as of now)	Elf Loader
1.00-7.61	BD reader for PS5 + BD writer + BD-RE	N/A	umtx UaF	BD-JB2	PoC by flatz	Native code execution within Blu-ray context
1.00-7.61	vulnerable game in disc or PS Store version + exploit game save data on the SSD	N/A	umtx UaF	PS4 disc-based game save data exploit that hijacks the LUA interpreter	LUA PoC by flatz but the exploit game save data is missing	Elf Loader