Vulnerabilities: Difference between revisions

From PS5 Developer wiki
Jump to navigation Jump to search
 
(15 intermediate revisions by the same user not shown)
Line 27: Line 27:


== WebKit exploits ==
== WebKit exploits ==
Contrarly to PS4, on PS5 WebKit exploit usually do not allow arbitrary RW to usermode code sections because of PS5 memory protections (notably XOM). However thanks to leaks of usermode libraries .text section binaries, by other sort of vulnerabilities, and to RW access to WebKit .data section allowed by the WebKit exploit, it is possible to trigger usermode ROP code execution.


=== Modal Browser HTTPS Bypass ===
=== Modal Browser HTTPS Bypass ===
Line 47: Line 49:


Tested and working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.
Tested and working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.
=== Untested - mmap issue involving pointer address misalignment leading to nothing for now ===
==== Credits ====
* Jasmine, working for Sony, for information through a WebKit commit (2022-10-19)
==== Analysis ====
* https://bugs.webkit.org/show_bug.cgi?id=246763
==== Bug Description ====
There is a mmap issue involving pointer address misalignment because of a failing assert [https://github.com/WebKit/WebKit/blob/main/Source/JavaScriptCore/heap/StructureAlignedMemoryAllocator.cpp#L94 here]. A workaround is to set HAVE_MAP_ALIGNED flag as OFF in OptionsPlayStation.cmake: [https://github.com/WebKit/WebKit/commit/626585db9857b7630cf34d82f9a0555720f15bca]. This workaround can be reverted after the mmap issue is resolved. Currently, the workaround is still enabled: [https://github.com/WebKit/WebKit/blob/ab2fff92b37e52d6c65e215b155e6b92f1646954/Source/cmake/OptionsPlayStation.cmake#L251]
OptionsPlayStation.cmake is present in the PS4 11.00 OSS WebKit source code but does not contain the HAVE_MAP_ALIGNED flag, and according to dates, this might concern only the PS5.
==== Exploit Implementation ====
==== Patched ====
'''Maybe'''
==== Tested ====
Not tested yet on PS4 nor PS5.
----
=== FW ?6.00-9.60? - get_by_id_with_this associated with ProxyObject can leak JSScope objects ===
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_?6.00-11.52?_-_get_by_id_with_this_associated_with_ProxyObject_can_leak_JSScope_objects].
=== FW ?6.00-9.60? - Immediate overflow/underflow in JSC SBFX (CVE-2024-27833) leading to arbitrary code execution ===
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_?10.00-11.52?_-_Immediate_overflow/underflow_in_JSC_SBFX_(CVE-2024-27833)_leading_to_arbitrary_code_execution].
=== FW ?6.00?-9.60 - Unknown heap and string overflow (no CVE) leading to crash ===
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_?10.00?-11.52_-_Unknown_heap_and_string_overflow_(no_CVE)_leading_to_crash].
==== Patched ====
'''Yes''' on PS4 FW 12.00 and PS5 FW 10.00.
==== Tested ====
Tested working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.
=== FW ?6.00-8.60? - Integer underflow in JSC genericTypedArrayViewProtoFuncCopyWithin (CVE-2023-38600) ===
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_?6.00-11.52?_-_Integer_underflow_in_JSC_genericTypedArrayViewProtoFuncCopyWithin_(CVE-2023-38600)].
=== FW ?6.00-8.60? - JSC::DFG::clobberize() needs to be more precise with the *ByOffset nodes (CVE-2023-41993) leading to arbitrary RW ===
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_?10.00-11.02?_-_JSC::DFG::clobberize()_needs_to_be_more_precise_with_the_*ByOffset_nodes_(CVE-2023-41993)_leading_to_arbitrary_RW].


=== FW 6.00-8.60 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW ===
=== FW 6.00-8.60 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW ===
Line 73: Line 125:


=== FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution ===
=== FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution ===
Contrarly to PS4, on PS5 this exploit does not allow arbitrary usermode memory RW because of PS5 memory protections. However thanks to tricks it is possible to get usermode ROP code execution from this exploit.


See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_9.00-9.04_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW].
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_9.00-9.04_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW].
Line 80: Line 130:
==== Implementations ====
==== Implementations ====


* [https://github.com/ChendoChap/PS5-Webkit-Execution Implementation for PS5 by ChendoChap]
* [https://github.com/ChendoChap/PS5-Webkit-Execution Implementation for PS5 3.00-4.51 by ChendoChap]
* [https://github.com/Cryptogenic/PS5-IPV6-Kernel-Exploit Implementation with IPV6 kernel exploit for PS5 3.00-4.51 by Specter]


==== Patched ====
==== Patched ====


'''No''' as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00).
'''No''' as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00). Not working on PS4 FWs <9.00 and PS5 FWs <2.10.


==== Tested ====
==== Tested ====


Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00.
Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.70 and >=5.00.


== Game savedata exploits ==
== Game savedata exploits ==
Line 125: Line 176:


= Kernel =
= Kernel =
== CR0.WP and XOM bypass ==
See [https://www.psdevwiki.com/ps4/Vulnerabilities#CR0.WP_protection PS4 dev wiki].
=== Credits ===
* sleirsgoevy for proposing it in PS4 kernel exploit since System Software version 6.51.
* Specter for adapting it to PS5 and explaining it.
=== Patched ===
'''Maybe''' in PS5 FW 5.00.
----


== Physical memory readable by kernel (Meme Dumper) ==
== Physical memory readable by kernel (Meme Dumper) ==
Line 233: Line 298:


* See also implementation for FreeBSD 9 or 12 or PS4.
* See also implementation for FreeBSD 9 or 12 or PS4.
* [https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Kernel exploit implementation for PS5 3.00-4.51 by Specter (2022-10-02)]
* [https://github.com/Cryptogenic/PS5-IPV6-Kernel-Exploit IPV6 kernel exploit implementation with W for PS5 3.00-4.51 by Specter (2022-10-02)]
* [https://github.com/sleirsgoevy/bd-jb/tree/ps5/root/org/homebrew ]


=== Patched ===
=== Patched ===


'''Yes''' in PS5 FW 5.00. Invulnerable in PS5 FW 2.50 and below.
'''Yes''' in PS5 FW 5.00. Invulnerable in PS5 FW 2.70 and below.
----
----


Line 250: Line 316:
=== Exploit Implementation ===
=== Exploit Implementation ===


Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic.
Edit: it may now be possible to build a valid PS5 exFAThax payload thanks to PS5 kernel .text segment dumps for System Software versions <= 2.70 thanks to Hypervisor exploits.
 
Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel .text segment dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic.


=== Patched ===
=== Patched ===
Line 280: Line 348:
'''Yes''' in PS5 FW 2.30 or later according to dates.
'''Yes''' in PS5 FW 2.30 or later according to dates.
----
----
== Kernel securities ==
=== dlsym syscall removed ===
Since PS5 System Software version 5.00, dlsym syscall is disabled (?removed?). dlsym could be used to resolve functions and variables addresses by their name. This was convenient for multi-firmware support.
Workaround: in the same way as in PSP and PS Vita HBL, and vitasploit, a workaround is to resolve functions by per-version offsets manually.
=== MAP_SELF flag removed ===
Since PS5 System Software version 5.00, MAP_SELF flag is nonexistent. MAP_SELF flag could be used for decrypting PS5 usermode SELFs such as eboot.bin and SUPRXs for games and applications, and system SELFs from /system and /system_ex, etc.
Workaround: using the PSP functions directly like Specter does.


= Secure Kernel =
= Secure Kernel =
Line 289: Line 371:
Potentially vulnerable on PS5 FWs <= 4.03.
Potentially vulnerable on PS5 FWs <= 4.03.


= Secure Loader =
= Hypervisor =


== Symmetric PS5 root keys dump by software exploit by Fail0verflow ==
Without a Hypervisor bypass/compromise, you are essentially limited to "data-only" attacks in kernel and usermode. Since patching the kernel is the most straightforward and direct way to achieve true homebrew on the PlayStation 5, bypassing or compromising the PS5 Hypervisor is necessary. Getting code execution in the PS5 Hypervisor allows one to dump and modify kernel .text segment, and to disable some protections. Moreover, chained with a higher level vulnerability, Hypervisor code can dump AMD PSP memory.


See [https://twitter.com/fail0verflow/status/1457526453105569793 Fail0verflow's announcement on Twitter (2021-11-08)]
== <=4.51 - Hypervisor bypass vulnerability ==
 
=== Credits ===


Fail0verflow either has a bootrom execution exploit or an AMD/ARM PSP hack.
* Discovered by anonymous (probably shuffle from fail0verflow or TheFloW). Announced by Flatz (2024-10-05).


''It is speculated that this exploit is a derivative of the ZenBleed [https://nvd.nist.gov/vuln/detail/CVE-2023-20593 CVE-2023-20593] exploit, as the PS5 APU is a custom ZEN 2 Ryzen chip.''
=== Bug description ===


This allows to decrypt on PC most parts of the PS5 System Software files including:
* Not disclosed yet.
* PUP
* secure loader (?AMD? ARM Platform Security Processor module) of Oberon
And by derivation, mostly like on PS Vita:
* secure modules
* kernel boot loader / BIOS
* non-secure kernel
* usermode system modules


Potentially unpatched.
=== Patched ===


= Hypervisor =
* Patched since PS5 FW 5.00.
 
== <=?2.70? - APIC pointers in kernel data segment ==
 
=== Credits ===
 
* Discovered by flatz. Disclosed publicly by flatz (2024-10-09).
 
=== Bug description ===
 
The apic_ops structure is located in the PS5 kernel .data segment which has RW permissions. Using a kernel vulnerability, you can overwrite a function pointer inside the apic_ops structure, like xapic_mode. This allows to launch a ROP chain but one has to bypass the CFI protection. After doing a PS5 suspend/resume cycle, the ROP code will be executed before Hypervisor restarts. The ROP chain can apply patches in kernel .text section.
 
* [https://twitter.com/flat_z/status/1843966331093438891 flatz explanation on twitter (2024-10-09)]
 
=== Patched ===
 
* Maybe on PS5 FW 3.00.
 
== <=2.70 - System Level debug flag in kernel data segment and not wiped after rest mode (Byepervisor bug #2) ==
 
=== Credits ===
 
* Discovered by Specter and ChendoChap (2023-07-01, [https://twitter.com/SpecterDev/status/1840303332763512837 Specter's announcement]).
* Disclosed publicly by Specter at Hardwear.io 2024 conference (2024-10-24).
 
=== Bug description ===
 
On PS5 System Software version 2.70 and lower, the System Quality Assurance (QA) flags are shared between the Hypervisor and the guest kernel. When the hypervisor initializes, the init code for constructing nested page tables will check QA flags for the System Level (SL) debugging flag. If this flag is set, the nested Page Table Entries (PTEs) will not have the xotext bit set for kernel .text pages, and further the kernel .text pages will also have the write bit set.
 
These flags are not reinitialized by the Secure Loader upon resume from PS5 sleep mode, though the hypervisor is. By setting the SL flag, then putting the system to sleep and resuming, we can edit the guest kernel's page tables to make kernel .text pages readable and writable, allowing kernel dump and patches.
 
=== Analysis ===
 
* [https://github.com/PS5Dev/Byepervisor/blob/main/Byepervisor_%20Breaking%20PS5%20Hypervisor%20Security.pdf Writeup of Byepervisor by Specter (2024-10-26)]
 
=== Implementation ===
 
* [https://github.com/PS5Dev/Byepervisor Implementation of Byepervisor bug #2 by Specter (2024-10-24)]
* [https://www.youtube.com/watch?v=lkd0qgr-4zk Demonstration video of Byepervisor bug #2 by Specter (2024-10-22)]
 
=== Patched ===
 
'''Yes''' since PS5 FW 3.00.
 
== <=2.70 - Hypervisor virtual tables in kernel data segment (Byepervisor bug #1) ==
 
=== Credits ===
 
* Discovered by Specter and ChendoChap (2023-07-01, [https://twitter.com/SpecterDev/status/1840303332763512837 Specter's announcement]) and Flatz (before 2023-07-27).
* Disclosed publicly by Specter at Hardwear.io 2024 conference (2024-10-24).
 
=== Bug description ===
 
On PS5 System Software version 2.70 and lower, the Hypervisor's [[Hypervisor#Hypercalls]] virtual tables are shared with the guest kernel. It is possible to hijack some entries (for example VMMCALL_HV_SET_CPUID_PS4) in the hypercalls virtual table to jump to a ROP chain. On System Software version 2.70 and lower, this virtual table is stored in the kernel .data segment. By using two ROP chains, one for setting up hypervisor registers and one for executing code in hypervisor. Indeed, the registers used by the Hypervisor are preserved accross Virtual Machine exit boundary. The ROP chain disables Nested Paging (NPT) and Guest Mode Execute Trap (GMET), which allows us to disable eXecute Only Memory (XOM) aka xotext in the kernel Page Table Entries (PTEs) to dump it, as well as enabling write in the PTEs to hook/patch the kernel as well.
 
This method requires a fair number of gadgets and offsets, which is the main reason this exploit is deprecated over the Byepervisor bug #2. This method also currently only breaks the hypervisor on the core the ROP chain runs on. The hypervisor is still active on other cores and would need to be disabled.
 
=== Analysis ===
 
* [https://github.com/PS5Dev/Byepervisor/blob/main/Byepervisor_%20Breaking%20PS5%20Hypervisor%20Security.pdf Writeup of Byepervisor by Specter (2024-10-26)]
 
=== Implementation ===
 
* [https://github.com/PS5Dev/Byepervisor/tree/main/_old_jump_table_exploit Implementation of Byepervisor bug #1 by Specter (2024-10-24)]
 
=== Patched ===
 
'''Yes''' since PS5 FW 3.00.
 
== <=2.70 - Hypervisor integrated as part of the kernel binary ==
 
=== Credits ===
 
* Discovered by shuffle from fail0verflow (in 2020), Specter and ChendoChap (2023-07-01) and Flatz (before 2023-07-27).
 
=== Bug description ===
 
On PS5 System Software version 2.70 and lower, the Hypervisor is integrated as part of the kernel binary. This makes Hypervisor exploitation easier as it can be triggered by usermode directly without the need of a kernel exploit. Later versions have the Hypervisor as a separately loaded component.
 
* See [[Hypervisor#In-Kernel_Hypervisor_.28.3C.3D_2.70.29]] and [https://wololo.net/2023/07/02/ps5-specterdev-shares-details-on-in-kernel-hypervisor-earlier-versions-of-the-ps5-hypervisor-found-in-firmwares/ wololo article (2023-07-02)].
 
=== Patched ===
 
'''Yes''' since PS5 FW 3.00.
 
= Secure Loader (software) - AMD Platform Security Processor (hardware) =
 
* The PS5 [[APU]] is a custom AMD ZEN 2 Ryzen chip that includes the [[AMD Platform Security Processor]] and the AMD SMU.
 
* The AMD Platform Security Processor runs the [[Secure Loader]] that is in charge of loading and executing [[Secure Modules]], like on PS4. The Secure Loader exports some SM management services to kernel through a mailbox.
 
* With a [[Hypervisor]] exploit, it is possible to exploit a vulnerability to dump the AMD Platform Security Processor memory. This dump contains the PS5 [[Secure Loader]]. This leads to PS5 symmetric root keys dump, that can then be used for decryption of most Secure Modules. This allows to decrypt on PC most parts of the PS5 System Software files (see also PS Vita 0xAA key fail impact) including:
* [[Secure Modules]]
* [[PUP]]
* kernel boot loader / [[BIOS]]
* non-secure [[Kernel]]
* usermode system [[Modules|modules]]
 
== <=2.70 - Software vulnerability leading to Secure Loader dump from Hypervisor ==
 
=== Credits ===
 
* Discovered by Shawn Hoffman (shuffle of fail0verflow) before 2021-09-08 and announced on 2021-11-08 ([https://twitter.com/fail0verflow/status/1457526453105569793 Fail0verflow's announcement on Twitter (2021-11-08)])
* Discovered independently and announced on 2023-07-27 by flatz ([https://twitter.com/flat_z/status/1684554194366107650 flatz's announcement on Twitter (2023-07-27)]).
 
=== Bug description ===
 
A software vulnerability triggered from the PS5 Hypervisor leads to [[AMD Platform Security Processor]] memory dump.
 
It must be noted that Shawn Hoffman (fail0verflow, Microsoft Offensive Security Research) reported in 2020, 2021 and 2022 many vulnerabilities affecting AMD Security Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), and other AMD platform components.
 
From [https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1021.html AMD Server Vulnerabilities – November 2021]:
CVE-2021-26315, CVE-2021-26335, CVE-2021-26336, CVE-2021-26337, CVE-2021-26338, CVE-2021-26351, CVE-2021-26352.
 
The most probable vulnerabilities that could have been used are:
* CVE-2021-26315 6.9 (Medium): A CPU internal ROM improperly implements decryption of signed off-chip firmware. An attacker with physical access or high privileges could potentially exploit this vulnerability leading to the execution of arbitrary code on the PSP, compromising the authenticity of the attestation state. -> Note that flatz stated that he used only software, including Hypervisor code execution, but not hardware for his exploit, so it is the "attacker with high privileges" part that might be concerned.
* CVE-2021-26335 7.5 (High): Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an attacker to use attacker-controlled values prior to signature validation potentially resulting in arbitrary code execution. -> This reminds of the [https://wiki.henkaku.xyz/vita/Vulnerabilities#First_Loader_SLSK_buffer_overflow CMeP vulnerability] about [https://wiki.henkaku.xyz/vita/SLSK SLSK] header parsing found by Team Molecule for PS Vita.
* Other Shawn Hoffman's CVEs are related to the AMD System Management Unit (SMU) but mainly to trigger Denial of Service and it is not clear how AMD SMU could be used to dump AMD PSP's memory.
 
From [https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1028.html AMD Server Vulnerabilities - May 2022]:
CVE-2021-26347, CVE-2021-26350, CVE-2021-26372, CVE-2021-26373, CVE-2021-26375, CVE-2021-26376, CVE-2021-26378
 
These CVEs are mostly related to AMD SMU, not AMD PSP, and trigger Denial of Service but not Information Leak nor Code Execution.


== <=4.51 - Hypervisor bypass vulnerability ==
From [https://www.amd.com/en/resources/product-security/bulletin/amd-sb-1027.html AMD Client Vulnerabilities – May 2022]:
CVE-2021-26335, CVE-2021-26336, CVE-2021-26337, CVE-2021-26347, CVE-2021-26350, CVE-2021-26351, CVE-2021-26352, CVE-2021-26372, CVE-2021-26373, CVE-2021-26375, CVE-2021-26376, CVE-2021-26378


* Discovered by anonymous (probably fail0verflow or TheFloW). Announced by Flatz (2024-10-05).
These AMD Client CVEs are already listed in the 2021 and 2022 AMD Server Security Bulletins.


* Patched since PS5 FW 5.00.
See also [https://www.psxhax.com/threads/flat_z-confirms-ps5-hypervisor-exploitation-from-ps4-save-game.16063/ flatz's comments].


== <=2.50 - Hypervisor vulnerability leading to compromise and XOM bypass ==
=== Patched ===


* Discovered by Specter (2023-07-01) and Flatz (before 2023-07-27).
Maybe since 3.00. Vulnerable on PS5 FWs <= 2.70.
* Exploited privately by Specter and ChendoChap (2024-09-29).
* Will be disclosed publicly at Hardwear.io 2024 conference (2024-10-24).


* Patched since PS5 FW 3.00.
== Untested - VZEROUPPER Instruction on AMD Zen 2 can Leak Register File State - ZenBleed vulnerability (CVE-2023-20593) ==


== <=2.50 - Hypervisor integrated as part of the kernel binary ==
For more information see [[PS-Chi]]. It is still untested on PS5.


* Discovered by Specter (2023-07-01) and Flatz (before 2023-07-27).
=== Credits ===
* Exploited privately by Specter and ChendoChap (2024-09-29).


* This makes Hypervisor exploitation easier as it can be triggered by usermode directly without the need of a kernel exploit.
* Discovered by Tavis Ormandy of Google Information Security, helped by Eduardo Vela Nava, Alexandra Sandulescu and Josh Eads.
* Reported to AMD by Tavis Ormandy on 2023-05-15.
* AMD publish patches on 2023-07-20. Sony might have fixed the PS5 after this date.
* Publicly disclosed by Tavis Ormandy in 2023-07-24.


* See [[Hypervisor#In-Kernel_Hypervisor_.28.3C.3D_2.50.29]] and [https://wololo.net/2023/07/02/ps5-specterdev-shares-details-on-in-kernel-hypervisor-earlier-versions-of-the-ps5-hypervisor-found-in-firmwares/ wololo article (2023-07-02)].
=== Bug description ===


* This also allows to dump kernel .text segment once one has code execution in hypervisor. See [https://x.com/SpecterDev/status/1840303332763512837 Specter's tweet about PS5 kernel .text dump].
CVE-2023-20593 works on all AMD Zen 2 class processors, which includes at least the following products:


* Patched since PS5 FW 3.00.
    AMD Ryzen 3000 Series Processors
    AMD Ryzen PRO 3000 Series Processors
    AMD Ryzen Threadripper 3000 Series Processors
    AMD Ryzen 4000 Series Processors with Radeon Graphics
    AMD Ryzen PRO 4000 Series Processors
    AMD Ryzen 5000 Series Processors with Radeon Graphics
    AMD Ryzen 7020 Series Processors with Radeon Graphics
    AMD EPYC “Rome” Processors


= Platform Secure Processor =
There is no proof of concept specifically for the PS5, however we do know the PS5 uses a custom AMD Zen 2 chip. This is a hardware bug that can be triggered by software to exploit the system.


== <=2.50 - PSP dump via Hypervisor exploit ==
* [https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html AMD Security Bulletin for CVE-2023-20593]
* https://nvd.nist.gov/vuln/detail/CVE-2023-20593


* Discovered by Fail0verflow before 2023-07-27, discovered independently and announced on 2023-07-27 by flatz ([https://twitter.com/flat_z/status/1684554194366107650 Announcement by flatz (2023-07-27)]).
=== Analysis ===


* Thanks to this software exploit, flatz got access to most PS5 decryption keys.
* [https://www.vu.ls/blog/exploiting-zenbleed-from-chrome/ Writeup of exploiting zenbleed in Google Chrome by Trent Novelly (2023-10-10)]
* [https://lock.cmpxchg8b.com/zenbleed.html Writeup of zenbleed by Tavis Ormandy (2023-07-24)]
* [https://github.com/google/security-research/tree/master/pocs/cpus/zenbleed PoC and analysis of zenbleed by Tavis Ormandy (2023-07-24)]
* [https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=0bc3126c9cfa0b8c761483215c25382f831a7c6f AMD fix commit]


* See also [https://www.psxhax.com/threads/flat_z-confirms-ps5-hypervisor-exploitation-from-ps4-save-game.16063/ flatz's comments].
=== Patched ===


* Vulnerable on PS5 FWs <= 2.50 and potentially patched since 3.00.
Maybe since PS5 FW around 7.61 as AMD has since patched it by firmware update.


= Southbridge =
= Southbridge =


== EMC and EFC-EAP vulnerabilities leading to code execution ==
== EMC, EFC and EAP vulnerabilities leading to code execution ==


* Will be disclosed by Shawn Hoffman (of SYMBRKRS LLC, @shuffle2 of fail0verflow) at the Security Analyst Summit Conference 2024 on 22-25 October, 2024.
=== Credits ===


Exploits allowing code execution on EMC and EFC/EAP will be detailed, along with release of a tool which implements the exploits. The process of initial exploration/discovery will also be briefly covered. From a security researcher point of view, the exploits are interesting as they cover a hard-to-spot bug in a firmware state machine, and abusing hardware misconfiguration to bypass memory protection measures. The exploits/tooling allow for further research into the system.
* Disclosed by Shawn Hoffman (of SYMBRKRS LLC, @shuffle2 of fail0verflow) at the Security Analyst Summit Conference 2024 (2024-10-23).
 
=== Bug description ===
 
These exploits allow code execution on EMC, EFC and EAP. The exploits are interesting as they cover a hard-to-spot bug in a firmware state machine, and abusing hardware misconfiguration to bypass memory protection measures.
 
It is required to solder to [[Service Connectors]] to make use of these vulnerabilities.
 
=== Analysis ===
 
* [https://symbrkrs.com/presentations/Beyond_Oberon-SAS2024.pdf Slides of the presentation at SAS24 Conference by shuffle (2024-10-23)]
 
=== Implementation ===
 
* [https://github.com/symbrkrs/ps5-uart Software to be used with a Raspberry Pi Pico to unlock PS5 EMC UART and EMC/EFS/EAP code execution by shuffle (2024-10-23)]
 
In shuffle's implementation, only the Raspberry Pi Pico is supported with the UF2 firmware.
 
Additionally, only the following PS5 EMC versions are supported for now (see [https://github.com/symbrkrs/ps5-uart/blob/main/uart/emc_shellcode.S shuffle's ps5-uart source code]):
* E1E 0001 0000 0004 13d0
* E1E 0001 0002 0003 1580
* E1E 0001 0004 0002 1752


= Unclassified =
= Unclassified =


== TheFloW's neither usermode nor kernel exploit ==
== <=?9.40? - TheFloW's neither usermode nor kernel vulnerability ==


* On 2024-08-29, TheFloW received 10.000$ from Sony for disclosing privately on Sony's HackerOne bug bounty program a vulnerability.
* On 2024-08-29, TheFloW received 10.000$ from Sony for disclosing privately a vulnerability on Sony's HackerOne bug bounty program.


* According to Flatz, this vulnerability affects neither usermode nor kernel, so it might be either about hardware or more likely about Hypervisor.
* According to Flatz, this vulnerability affects neither usermode nor kernel, so it might be about hardware (AMD PSP maybe) or still software but more likely about Hypervisor or Secure Loader or Secure Modules.


* This vulnerability probably got patched in PS5 FW 10.00 or in PS5 FW 9.60, or if it is not patchable by software, is patched in new hardware revisions of the PS5.
=== Patched ===
 
= Hardware =


== Untested: ZenBleed (''[https://nvd.nist.gov/vuln/detail/CVE-2023-20593 CVE-2023-20593]) leak register contents directly from the CPU.'' ==
Maybe in PS5 FW 10.00 or in PS5 FW 9.60, or if it is not patchable by software, is patched in new hardware revisions of the PS5.
This is a well documented CPU vulnerability in AMD Processors with the Zen 2 microarchitecture. There is no proof of concept specifically for the PS5, however we do know the PS5 uses a custom Zen 2 chip. This is a hardware bug that uses software to exploit the system. AMD has since patched this with [https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7008.html software], but we are unsure of the status for the latest PS5 firmware (assumed to be patched). For more information see [[PS-Chi]].

Latest revision as of 12:09, 30 October 2024

Usermode[edit | edit source]

BD-J exploits[edit | edit source]

FW <= 7.61 - BD-JB2 - Path traversal sandbox escape by TheFloW[edit | edit source]

See [1].

Patched[edit | edit source]

Yes on PS5 FW 8.00.

FW <= 4.51 - BD-JB - Five vulnerabilities chained by TheFloW[edit | edit source]

See [2].

Implementations[edit | edit source]

Patched[edit | edit source]

Yes partially on PS5 FWs > 4.50 (need to test). Probably unpatched on FW 4.51 and patched on FW 5.00.

WebKit exploits[edit | edit source]

Contrarly to PS4, on PS5 WebKit exploit usually do not allow arbitrary RW to usermode code sections because of PS5 memory protections (notably XOM). However thanks to leaks of usermode libraries .text section binaries, by other sort of vulnerabilities, and to RW access to WebKit .data section allowed by the WebKit exploit, it is possible to trigger usermode ROP code execution.

Modal Browser HTTPS Bypass[edit | edit source]

  • It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The web browser will just display that response. The downside to this is that you have no idea of what the contents of even the HTTP REQUEST would have been, but it is useful for redirecting the web browser to any website you want.

Patched[edit | edit source]

No as of PS5 FW 5.10.

FW 6.00-9.60 - Unknown heap and string overflow (no CVE) leading to crash[edit | edit source]

See also [3].

Patched[edit | edit source]

Yes on PS4 FW 12.00 and PS5 FW 10.00.

Tested[edit | edit source]

Tested and working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.

Untested - mmap issue involving pointer address misalignment leading to nothing for now[edit | edit source]

Credits[edit | edit source]

  • Jasmine, working for Sony, for information through a WebKit commit (2022-10-19)

Analysis[edit | edit source]

Bug Description[edit | edit source]

There is a mmap issue involving pointer address misalignment because of a failing assert here. A workaround is to set HAVE_MAP_ALIGNED flag as OFF in OptionsPlayStation.cmake: [4]. This workaround can be reverted after the mmap issue is resolved. Currently, the workaround is still enabled: [5]

OptionsPlayStation.cmake is present in the PS4 11.00 OSS WebKit source code but does not contain the HAVE_MAP_ALIGNED flag, and according to dates, this might concern only the PS5.

Exploit Implementation[edit | edit source]

Patched[edit | edit source]

Maybe

Tested[edit | edit source]

Not tested yet on PS4 nor PS5.


FW ?6.00-9.60? - get_by_id_with_this associated with ProxyObject can leak JSScope objects[edit | edit source]

See also [6].

FW ?6.00-9.60? - Immediate overflow/underflow in JSC SBFX (CVE-2024-27833) leading to arbitrary code execution[edit | edit source]

See also [7].

FW ?6.00?-9.60 - Unknown heap and string overflow (no CVE) leading to crash[edit | edit source]

See also [8].

Patched[edit | edit source]

Yes on PS4 FW 12.00 and PS5 FW 10.00.

Tested[edit | edit source]

Tested working on PS4 FWs 10.00-11.52 and PS5 FWs 6.00-9.60.

FW ?6.00-8.60? - Integer underflow in JSC genericTypedArrayViewProtoFuncCopyWithin (CVE-2023-38600)[edit | edit source]

See also [9].

FW ?6.00-8.60? - JSC::DFG::clobberize() needs to be more precise with the *ByOffset nodes (CVE-2023-41993) leading to arbitrary RW[edit | edit source]

See also [10].

FW 6.00-8.60 - JSC DFG Abstract Intepreter clobberWorld Type Confusion (no CVE) leading to arbitrary RW[edit | edit source]

See also [11].

Patched[edit | edit source]

Yes on PS4 FW 11.50 and PS5 FW 9.00.

Tested[edit | edit source]

Tested and working on PS4 FWs 10.00-11.02 and PS5 FWs 6.00-8.60.

FW <= 5.50 - FrameLoader::loadInSameDocument() UaF (CVE-2022-22620) leading to arbitrary RW[edit | edit source]

See also [12].

Patched[edit | edit source]

Yes on PS4 FW 10.00 and PS5 FW 6.00.

Tested[edit | edit source]

Tested and working on PS4 FWs 6.00-9.60 and PS5 FWs 1.00-5.50.

FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution[edit | edit source]

See also [13].

Implementations[edit | edit source]

Patched[edit | edit source]

No as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00). Not working on PS4 FWs <9.00 and PS5 FWs <2.10.

Tested[edit | edit source]

Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.70 and >=5.00.

Game savedata exploits[edit | edit source]

PS1 games savedata exploits[edit | edit source]

See PS4 Dev Wiki.

PS2 game savedata exploits[edit | edit source]

See PS4 Dev Wiki.

PSP games savedata exploits[edit | edit source]

See PS4 Dev Wiki.

PS4/PS5 PS2emu sandbox escape (mast1c0re)[edit | edit source]

See PS4 Dev Wiki.

PS4/PS5 game savedata LUA exploit[edit | edit source]

See PS4 Dev Wiki.

PS4 emulator exploits[edit | edit source]

Nothing yet.

Usermode securities[edit | edit source]

See also PS4 usermode securities.

>=8.00 - Syscalls and libkernel blocked from main usermode applications[edit | edit source]

Since PS5 System Software version 8.00, in order to make the PS5 less vulnerable to kernel escalation from usermode after TheFloW's disclose of BD-JB2, Sony blocked syscall and libkernel access from the main contenders such as BD JAVA, WebKit, PS2emu and probably more else all usermode applications.

Kernel[edit | edit source]

CR0.WP and XOM bypass[edit | edit source]

See PS4 dev wiki.

Credits[edit | edit source]

  • sleirsgoevy for proposing it in PS4 kernel exploit since System Software version 6.51.
  • Specter for adapting it to PS5 and explaining it.

Patched[edit | edit source]

Maybe in PS5 FW 5.00.


Physical memory readable by kernel (Meme Dumper)[edit | edit source]

Credits[edit | edit source]

Discovered by cheburek3000. Released on 2023-02-07 by cheburek3000.

Bug Description[edit | edit source]

Steps:

1. Find kernel_pmap_store offset in kernel data segment. You can guess its location by specific signature (see guess_kernel_pmap_store_offset code). Luckily kernel_pmap_store has physical and virtual addresses for PML4.

2. Through physical and virtual addresses for PML4, you can find physical memory mapped directly to the kernel memory (DMAP). See PADDR_TO_DMAP macro and vmparam.h from FreeBSD for reference.

3. Use page tables to convert any kernel virtual address to physical address (see vaddr_to_paddr code).

4. Access data by physical address through DMAP.

Exploit Implementation[edit | edit source]

Patched[edit | edit source]

No in PS5 FW 4.51.


FW <= 7.61 - umtx UaF (yielding arbitrary kernel R/W) (CVE-2024-43102)[edit | edit source]

Credits[edit | edit source]

  • [email protected] for discovering the vulnerability, keeping it secret (2020-12) then sharing a writeup (2024-09-06)
  • Rebecca Cran for discovering the bug in umtx (2023-05-07)
  • Synacktiv for finding and disclosing publicly the vulnerability (2024-09-04)
  • Olivier Certner for fixing the bug (2024-09-04), kib for reviewing the bug fix (2024-09-04), Ed Maste for approving the bug fix commit (2024-09-04)
  • Shuffle from Fail0verflow for the FreeBSD 11 and PS5 PoC in C++ (2024-09-14)
  • Flatz for writing a PS5 exploit chain with TheFloW's BD-JB2 (2024-09-14)
  • Specter for chaining the kernel exploit with PsFree WebKit exploit (2024-09-21)

Analysis[edit | edit source]

Bug Description[edit | edit source]

The _umtx_op(2) system call provides support for the implementation of synchronization primitives between threads, and is used by the 1:1 Threading Library (libthr, -lthr) to implement IEEE Std 1003.1-2001 (POSIX.1-2001) pthread locks, like mutexes, condition variables and so on. In particular, its UMTX_OP_SHM operation provides support for anonymous shared memory associated to a particular physical address, which is used to implement process-shared mutexes (PTHREAD_PROCESS_SHARED).

Concurrent removals of such a mapping by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreasing the reference count of the object representing the mapping too many times, causing it to be freed too early.

umtx_shm_unref_reg_locked() would unconditionally drop the "registry" reference, tied to USHMF_LINKED.

This is not a problem for caller umtx_shm_object_terminated(), which operates under the 'umtx_shm_lock' lock end-to-end, but it is for indirect caller umtx_shm(), which drops the lock between umtx_shm_find_reg() and the call to umtx_shm_unref_reg(true) that deregisters the umtx shared region (from 'umtx_shm_registry'; umtx_shm_find_reg() only finds registered shared mutexes).

Thus, two concurrent user-space callers of _umtx_op() with UMTX_OP_SHM and flags UMTX_SHM_DESTROY, both progressing past umtx_shm_find_reg() but before umtx_shm_unref_reg(true), would then decrease twice the reference count for the single reference standing for the shared mutex's registration.

A malicious code exercizing the UMTX_SHM_DESTROY sub-request in parallel can panic the kernel or enable further Use-After-Free attacks, potentially including code execution or Capsicum sandbox escape.

Exploit Implementation[edit | edit source]

Patched[edit | edit source]

Yes in PS5 FW 8.00.


FW <= 8.20 - Remote vulnerabilities in spp (yielding kernel panic) (CVE-2006-4304 and no-CVE)[edit | edit source]

See the PS4 wiki.

Note that kernel ASLR defeat is currently not working on PS5 and there are protections remaining before being able to get ROP chain execution in kernel.

Patched[edit | edit source]

Yes in PS5 FW 8.40.


FW <= ?3.21? - PPPoE driver remote buffer overflow (CVE-2022-29867)[edit | edit source]

See the PS4 wiki.

Note that PS5 is maybe not affected even though PS4 is.

Patched[edit | edit source]

Probably in PS5 FW 4.00.


FW 3.00-4.51 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457)[edit | edit source]

See the PS4 wiki.

Credits[edit | edit source]

  • Discovered for PS4 and ported to PS5 by TheFloW.

Exploit Implementation[edit | edit source]

Patched[edit | edit source]

Yes in PS5 FW 5.00. Invulnerable in PS5 FW 2.70 and below.


FW <= 4.03 - exFAT driver heap-based buffer overflow[edit | edit source]

See the PS4 wiki.

Credits[edit | edit source]

Discovered by TheFloW. Disclosed by ChendoChap.

Exploit Implementation[edit | edit source]

Edit: it may now be possible to build a valid PS5 exFAThax payload thanks to PS5 kernel .text segment dumps for System Software versions <= 2.70 thanks to Hypervisor exploits.

Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel .text segment dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic.

Patched[edit | edit source]

Yes in PS5 FW 4.50.


SMAP bypass (CVE-2021-29628)[edit | edit source]

See also PS4 SMAP bypass.

Credits[edit | edit source]

  • Discovered and disclosed publicly by m00nbsd. Disclosed to SIE on 2020-12-01.

Analysis[edit | edit source]

Bug Description[edit | edit source]

In FreeBSD 13.0-STABLE before n245764-876ffe28796c, 12.2-STABLE before r369857, 13.0-RELEASE before p1, and 12.2-RELEASE before p7, a system call triggering a fault could cause SMAP protections to be disabled for the duration of the system call. This weakness could be combined with other kernel bugs to craft an exploit. It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.

Patched[edit | edit source]

Yes in PS5 FW 2.30 or later according to dates.


Kernel securities[edit | edit source]

dlsym syscall removed[edit | edit source]

Since PS5 System Software version 5.00, dlsym syscall is disabled (?removed?). dlsym could be used to resolve functions and variables addresses by their name. This was convenient for multi-firmware support.

Workaround: in the same way as in PSP and PS Vita HBL, and vitasploit, a workaround is to resolve functions by per-version offsets manually.

MAP_SELF flag removed[edit | edit source]

Since PS5 System Software version 5.00, MAP_SELF flag is nonexistent. MAP_SELF flag could be used for decrypting PS5 usermode SELFs such as eboot.bin and SUPRXs for games and applications, and system SELFs from /system and /system_ex, etc.

Workaround: using the PSP functions directly like Specter does.

Secure Kernel[edit | edit source]

Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel[edit | edit source]

See [16].

Potentially vulnerable on PS5 FWs <= 4.03.

Hypervisor[edit | edit source]

Without a Hypervisor bypass/compromise, you are essentially limited to "data-only" attacks in kernel and usermode. Since patching the kernel is the most straightforward and direct way to achieve true homebrew on the PlayStation 5, bypassing or compromising the PS5 Hypervisor is necessary. Getting code execution in the PS5 Hypervisor allows one to dump and modify kernel .text segment, and to disable some protections. Moreover, chained with a higher level vulnerability, Hypervisor code can dump AMD PSP memory.

<=4.51 - Hypervisor bypass vulnerability[edit | edit source]

Credits[edit | edit source]

  • Discovered by anonymous (probably shuffle from fail0verflow or TheFloW). Announced by Flatz (2024-10-05).

Bug description[edit | edit source]

  • Not disclosed yet.

Patched[edit | edit source]

  • Patched since PS5 FW 5.00.

<=?2.70? - APIC pointers in kernel data segment[edit | edit source]

Credits[edit | edit source]

  • Discovered by flatz. Disclosed publicly by flatz (2024-10-09).

Bug description[edit | edit source]

The apic_ops structure is located in the PS5 kernel .data segment which has RW permissions. Using a kernel vulnerability, you can overwrite a function pointer inside the apic_ops structure, like xapic_mode. This allows to launch a ROP chain but one has to bypass the CFI protection. After doing a PS5 suspend/resume cycle, the ROP code will be executed before Hypervisor restarts. The ROP chain can apply patches in kernel .text section.

Patched[edit | edit source]

  • Maybe on PS5 FW 3.00.

<=2.70 - System Level debug flag in kernel data segment and not wiped after rest mode (Byepervisor bug #2)[edit | edit source]

Credits[edit | edit source]

  • Discovered by Specter and ChendoChap (2023-07-01, Specter's announcement).
  • Disclosed publicly by Specter at Hardwear.io 2024 conference (2024-10-24).

Bug description[edit | edit source]

On PS5 System Software version 2.70 and lower, the System Quality Assurance (QA) flags are shared between the Hypervisor and the guest kernel. When the hypervisor initializes, the init code for constructing nested page tables will check QA flags for the System Level (SL) debugging flag. If this flag is set, the nested Page Table Entries (PTEs) will not have the xotext bit set for kernel .text pages, and further the kernel .text pages will also have the write bit set.

These flags are not reinitialized by the Secure Loader upon resume from PS5 sleep mode, though the hypervisor is. By setting the SL flag, then putting the system to sleep and resuming, we can edit the guest kernel's page tables to make kernel .text pages readable and writable, allowing kernel dump and patches.

Analysis[edit | edit source]

Implementation[edit | edit source]

Patched[edit | edit source]

Yes since PS5 FW 3.00.

<=2.70 - Hypervisor virtual tables in kernel data segment (Byepervisor bug #1)[edit | edit source]

Credits[edit | edit source]

  • Discovered by Specter and ChendoChap (2023-07-01, Specter's announcement) and Flatz (before 2023-07-27).
  • Disclosed publicly by Specter at Hardwear.io 2024 conference (2024-10-24).

Bug description[edit | edit source]

On PS5 System Software version 2.70 and lower, the Hypervisor's Hypervisor#Hypercalls virtual tables are shared with the guest kernel. It is possible to hijack some entries (for example VMMCALL_HV_SET_CPUID_PS4) in the hypercalls virtual table to jump to a ROP chain. On System Software version 2.70 and lower, this virtual table is stored in the kernel .data segment. By using two ROP chains, one for setting up hypervisor registers and one for executing code in hypervisor. Indeed, the registers used by the Hypervisor are preserved accross Virtual Machine exit boundary. The ROP chain disables Nested Paging (NPT) and Guest Mode Execute Trap (GMET), which allows us to disable eXecute Only Memory (XOM) aka xotext in the kernel Page Table Entries (PTEs) to dump it, as well as enabling write in the PTEs to hook/patch the kernel as well.

This method requires a fair number of gadgets and offsets, which is the main reason this exploit is deprecated over the Byepervisor bug #2. This method also currently only breaks the hypervisor on the core the ROP chain runs on. The hypervisor is still active on other cores and would need to be disabled.

Analysis[edit | edit source]

Implementation[edit | edit source]

Patched[edit | edit source]

Yes since PS5 FW 3.00.

<=2.70 - Hypervisor integrated as part of the kernel binary[edit | edit source]

Credits[edit | edit source]

  • Discovered by shuffle from fail0verflow (in 2020), Specter and ChendoChap (2023-07-01) and Flatz (before 2023-07-27).

Bug description[edit | edit source]

On PS5 System Software version 2.70 and lower, the Hypervisor is integrated as part of the kernel binary. This makes Hypervisor exploitation easier as it can be triggered by usermode directly without the need of a kernel exploit. Later versions have the Hypervisor as a separately loaded component.

Patched[edit | edit source]

Yes since PS5 FW 3.00.

Secure Loader (software) - AMD Platform Security Processor (hardware)[edit | edit source]

  • The AMD Platform Security Processor runs the Secure Loader that is in charge of loading and executing Secure Modules, like on PS4. The Secure Loader exports some SM management services to kernel through a mailbox.
  • With a Hypervisor exploit, it is possible to exploit a vulnerability to dump the AMD Platform Security Processor memory. This dump contains the PS5 Secure Loader. This leads to PS5 symmetric root keys dump, that can then be used for decryption of most Secure Modules. This allows to decrypt on PC most parts of the PS5 System Software files (see also PS Vita 0xAA key fail impact) including:
  • Secure Modules
  • PUP
  • kernel boot loader / BIOS
  • non-secure Kernel
  • usermode system modules

<=2.70 - Software vulnerability leading to Secure Loader dump from Hypervisor[edit | edit source]

Credits[edit | edit source]

Bug description[edit | edit source]

A software vulnerability triggered from the PS5 Hypervisor leads to AMD Platform Security Processor memory dump.

It must be noted that Shawn Hoffman (fail0verflow, Microsoft Offensive Security Research) reported in 2020, 2021 and 2022 many vulnerabilities affecting AMD Security Processor (ASP), AMD System Management Unit (SMU), AMD Secure Encrypted Virtualization (SEV), and other AMD platform components.

From AMD Server Vulnerabilities – November 2021: CVE-2021-26315, CVE-2021-26335, CVE-2021-26336, CVE-2021-26337, CVE-2021-26338, CVE-2021-26351, CVE-2021-26352.

The most probable vulnerabilities that could have been used are:

  • CVE-2021-26315 6.9 (Medium): A CPU internal ROM improperly implements decryption of signed off-chip firmware. An attacker with physical access or high privileges could potentially exploit this vulnerability leading to the execution of arbitrary code on the PSP, compromising the authenticity of the attestation state. -> Note that flatz stated that he used only software, including Hypervisor code execution, but not hardware for his exploit, so it is the "attacker with high privileges" part that might be concerned.
  • CVE-2021-26335 7.5 (High): Improper input and range checking in the AMD Secure Processor (ASP) boot loader image header may allow an attacker to use attacker-controlled values prior to signature validation potentially resulting in arbitrary code execution. -> This reminds of the CMeP vulnerability about SLSK header parsing found by Team Molecule for PS Vita.
  • Other Shawn Hoffman's CVEs are related to the AMD System Management Unit (SMU) but mainly to trigger Denial of Service and it is not clear how AMD SMU could be used to dump AMD PSP's memory.

From AMD Server Vulnerabilities - May 2022: CVE-2021-26347, CVE-2021-26350, CVE-2021-26372, CVE-2021-26373, CVE-2021-26375, CVE-2021-26376, CVE-2021-26378

These CVEs are mostly related to AMD SMU, not AMD PSP, and trigger Denial of Service but not Information Leak nor Code Execution.

From AMD Client Vulnerabilities – May 2022: CVE-2021-26335, CVE-2021-26336, CVE-2021-26337, CVE-2021-26347, CVE-2021-26350, CVE-2021-26351, CVE-2021-26352, CVE-2021-26372, CVE-2021-26373, CVE-2021-26375, CVE-2021-26376, CVE-2021-26378

These AMD Client CVEs are already listed in the 2021 and 2022 AMD Server Security Bulletins.

See also flatz's comments.

Patched[edit | edit source]

Maybe since 3.00. Vulnerable on PS5 FWs <= 2.70.

Untested - VZEROUPPER Instruction on AMD Zen 2 can Leak Register File State - ZenBleed vulnerability (CVE-2023-20593)[edit | edit source]

For more information see PS-Chi. It is still untested on PS5.

Credits[edit | edit source]

  • Discovered by Tavis Ormandy of Google Information Security, helped by Eduardo Vela Nava, Alexandra Sandulescu and Josh Eads.
  • Reported to AMD by Tavis Ormandy on 2023-05-15.
  • AMD publish patches on 2023-07-20. Sony might have fixed the PS5 after this date.
  • Publicly disclosed by Tavis Ormandy in 2023-07-24.

Bug description[edit | edit source]

CVE-2023-20593 works on all AMD Zen 2 class processors, which includes at least the following products:

   AMD Ryzen 3000 Series Processors
   AMD Ryzen PRO 3000 Series Processors
   AMD Ryzen Threadripper 3000 Series Processors
   AMD Ryzen 4000 Series Processors with Radeon Graphics
   AMD Ryzen PRO 4000 Series Processors
   AMD Ryzen 5000 Series Processors with Radeon Graphics
   AMD Ryzen 7020 Series Processors with Radeon Graphics
   AMD EPYC “Rome” Processors

There is no proof of concept specifically for the PS5, however we do know the PS5 uses a custom AMD Zen 2 chip. This is a hardware bug that can be triggered by software to exploit the system.

Analysis[edit | edit source]

Patched[edit | edit source]

Maybe since PS5 FW around 7.61 as AMD has since patched it by firmware update.

Southbridge[edit | edit source]

EMC, EFC and EAP vulnerabilities leading to code execution[edit | edit source]

Credits[edit | edit source]

  • Disclosed by Shawn Hoffman (of SYMBRKRS LLC, @shuffle2 of fail0verflow) at the Security Analyst Summit Conference 2024 (2024-10-23).

Bug description[edit | edit source]

These exploits allow code execution on EMC, EFC and EAP. The exploits are interesting as they cover a hard-to-spot bug in a firmware state machine, and abusing hardware misconfiguration to bypass memory protection measures.

It is required to solder to Service Connectors to make use of these vulnerabilities.

Analysis[edit | edit source]

Implementation[edit | edit source]

In shuffle's implementation, only the Raspberry Pi Pico is supported with the UF2 firmware.

Additionally, only the following PS5 EMC versions are supported for now (see shuffle's ps5-uart source code):

  • E1E 0001 0000 0004 13d0
  • E1E 0001 0002 0003 1580
  • E1E 0001 0004 0002 1752

Unclassified[edit | edit source]

<=?9.40? - TheFloW's neither usermode nor kernel vulnerability[edit | edit source]

  • On 2024-08-29, TheFloW received 10.000$ from Sony for disclosing privately a vulnerability on Sony's HackerOne bug bounty program.
  • According to Flatz, this vulnerability affects neither usermode nor kernel, so it might be about hardware (AMD PSP maybe) or still software but more likely about Hypervisor or Secure Loader or Secure Modules.

Patched[edit | edit source]

Maybe in PS5 FW 10.00 or in PS5 FW 9.60, or if it is not patchable by software, is patched in new hardware revisions of the PS5.