Vulnerabilities: Difference between revisions

From PS5 Developer wiki
Jump to navigation Jump to search
No edit summary
Line 3: Line 3:
== BD-J exploits ==
== BD-J exploits ==


=== FW <=7.61 - BD-JB2 - Path traversal sandbox escape by TheFloW ===
=== FW <= 7.61 - BD-JB2 - Path traversal sandbox escape by TheFloW ===


See [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=10.71_-_BD-JB2_-_Path_traversal_sandbox_escape_by_TheFloW].
See [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=10.71_-_BD-JB2_-_Path_traversal_sandbox_escape_by_TheFloW].
Line 11: Line 11:
'''Yes''' on PS5 FW 8.00.
'''Yes''' on PS5 FW 8.00.


=== FW <=4.51 - BD-JB - Five vulnerabilities chained by TheFloW ===
=== FW <= 4.51 - BD-JB - Five vulnerabilities chained by TheFloW ===


See [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=9.00_-_BD-JB_-_Five_vulnerabilities_chained_by_TheFloW].
See [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_%3C=9.00_-_BD-JB_-_Five_vulnerabilities_chained_by_TheFloW].
Line 38: Line 38:
'''No''' as of PS5 FW 5.10.
'''No''' as of PS5 FW 5.10.


=== FW <=5.50 - FrameLoader::loadInSameDocument UaF (CVE-2022-22620) leading to arbitrary RW ===
=== FW <= 5.50 - FrameLoader::loadInSameDocument UaF (CVE-2022-22620) leading to arbitrary RW ===


See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_6.00-9.60_-_FrameLoader::loadInSameDocument_UaF_(CVE-2022-22620)_leading_to_arbitrary_RW].
See also [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_6.00-9.60_-_FrameLoader::loadInSameDocument_UaF_(CVE-2022-22620)_leading_to_arbitrary_RW].
Line 84: Line 84:
= Kernel =
= Kernel =


== Physical Memory readable by kernel (Meme Dumper) ==
== Physical memory readable by kernel (Meme Dumper) ==


=== Credits ===
=== Credits ===
Discovered by cheburek3000. Released on 2023-02-07 by cheburek3000.
Discovered by cheburek3000. Released on 2023-02-07 by cheburek3000.


=== Bug Description ===
=== Bug Description ===
Steps:
Steps:


1. Find kernel_pmap_store offset in kernel data. You can guess its location by specific signature (see guess_kernel_pmap_store_offset code).
1. Find kernel_pmap_store offset in kernel data segment. You can guess its location by specific signature (see guess_kernel_pmap_store_offset code). Luckily kernel_pmap_store has physical and virtual addresses for PML4.


2. Luckily it has physical and virtual addresses for PML4. And through them you can find physical memory mapped directly to the kernel memory (DMAP). See PADDR_TO_DMAP macro and vmparam.h from FreeBSD for reference.
2. Through physical and virtual addresses for PML4, you can find physical memory mapped directly to the kernel memory (DMAP). See PADDR_TO_DMAP macro and vmparam.h from FreeBSD for reference.


3. Use page tables to convert any kernel address to physical address (see vaddr_to_paddr code).
3. Use page tables to convert any kernel virtual address to physical address (see vaddr_to_paddr code).


4. Access data by physical address through DMAP.
4. Access data by physical address through DMAP.


=== Exploit Implementation ===
=== Exploit Implementation ===
* [https://github.com/cheburek3000/meme_dumper]
* [https://github.com/cheburek3000/meme_dumper]


=== Patched ===
=== Patched ===
'''No''' in PS5 FW 4.51.
'''No''' in PS5 FW 4.51.
----
----


== FW 3.xx-4.xx - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457) ==
== FW 3.00-4.51 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457) ==


See the [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_.3C.3D_7.02_-_IPV6_2292PKTOPTIONS_UaF_.28yielding_arbitrary_kernel_R.2FW.29_.28CVE-2020-7457.29 PS4 wiki].
See the [https://www.psdevwiki.com/ps4/Vulnerabilities#FW_.3C.3D_7.02_-_IPV6_2292PKTOPTIONS_UaF_.28yielding_arbitrary_kernel_R.2FW.29_.28CVE-2020-7457.29 PS4 wiki].


=== Credits ===
=== Credits ===
* Discovered for PS4 and ported to PS5 by TheFloW.
* Discovered for PS4 and ported to PS5 by TheFloW.


=== Exploit Implementation ===
=== Exploit Implementation ===
* See also implementation for FreeBSD 9 or 12 or PS4.
* See also implementation for FreeBSD 9 or 12 or PS4.
* [https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Kernel exploit implementation for PS5 3.00-4.51 by Specter (2022-10-02)]
* [https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Kernel exploit implementation for PS5 3.00-4.51 by Specter (2022-10-02)]


=== Patched ===
=== Patched ===
'''Yes''' in PS5 FW 5.00 or 5.02. Invulnerable in PS5 FW 2.50 and below.
 
'''Yes''' in PS5 FW 5.00. Invulnerable in PS5 FW 2.50 and below.
----
----


Line 125: Line 132:


=== Credits ===
=== Credits ===
Discovered by TheFloW. Disclosed by ChendoChap.
Discovered by TheFloW. Disclosed by ChendoChap.


=== Exploit Implementation ===
=== Exploit Implementation ===
Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic.
Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic.


Line 133: Line 142:


=== Patched ===
=== Patched ===
'''Yes''' in PS5 FW 4.50.
'''Yes''' in PS5 FW 4.50.
----
----
Line 141: Line 151:


=== Credits ===
=== Credits ===
* Discovered and disclosed publicly by m00nbsd. Disclosed to SIE on 2020-12-01.
* Discovered and disclosed publicly by m00nbsd. Disclosed to SIE on 2020-12-01.


=== Analysis ===
=== Analysis ===
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd]
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd]
* [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd]
* [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd]


=== Bug Description ===
=== Bug Description ===
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.


=== Patched ===
=== Patched ===
'''Yes''' in PS5 FW 2.30 or later according to dates.
'''Yes''' in PS5 FW 2.30 or later according to dates.
----
----

Revision as of 23:44, 1 December 2023

Usermode

BD-J exploits

FW <= 7.61 - BD-JB2 - Path traversal sandbox escape by TheFloW

See [1].

Patched

Yes on PS5 FW 8.00.

FW <= 4.51 - BD-JB - Five vulnerabilities chained by TheFloW

See [2].

Implementations

Patched

Yes partially on PS5 FWs > 4.50 (need to test). Probably unpatched on FW 4.51 and patched on FW 5.00.

WebKit exploits

WebKit exploits are harder to make and do not even give arbitrary RW because of PS5 memory protections.

Modal Browser HTTPS Bypass

  • It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want.

Patched

No as of PS5 FW 5.10.

FW <= 5.50 - FrameLoader::loadInSameDocument UaF (CVE-2022-22620) leading to arbitrary RW

See also [3].

Patched

Yes on PS5 FW 6.00.

Tested

Tested and working on PS4 FWs 6.00-9.60 and PS5 FWs 1.00-5.50.

FW 3.00-4.51 - WebCore::CSSFontFaceSet vulnerabilities leading to usermode ROP code execution

Contrarly to PS4, on PS5 this exploit does not allow arbitrary usermode memory RW because of PS5 memory protections. However thanks to tricks it is possible to get usermode ROP code execution from this exploit.

See also [4].

Implementations

Patched

No as of PS5 FW 4.51 (need to test on PS5 FWs >=5.00).

Tested

Tested and working on PS4 FWs 9.00-9.04 and PS5 FWs 3.00-4.51. Untested: PS5 FWs 2.10-2.50 and >=5.00.

Game savedata exploits

PS2 games savedata exploits

See [5].

PS4/PS5 PS2emu sandbox escape (mast1c0re)

See [6].

PS4 emulator exploits

Nothing yet.

Kernel

Physical memory readable by kernel (Meme Dumper)

Credits

Discovered by cheburek3000. Released on 2023-02-07 by cheburek3000.

Bug Description

Steps:

1. Find kernel_pmap_store offset in kernel data segment. You can guess its location by specific signature (see guess_kernel_pmap_store_offset code). Luckily kernel_pmap_store has physical and virtual addresses for PML4.

2. Through physical and virtual addresses for PML4, you can find physical memory mapped directly to the kernel memory (DMAP). See PADDR_TO_DMAP macro and vmparam.h from FreeBSD for reference.

3. Use page tables to convert any kernel virtual address to physical address (see vaddr_to_paddr code).

4. Access data by physical address through DMAP.

Exploit Implementation

Patched

No in PS5 FW 4.51.

FW 3.00-4.51 - IPV6_2292PKTOPTIONS UaF (yielding arbitrary kernel R/W) (CVE-2020-7457)

See the PS4 wiki.

Credits

  • Discovered for PS4 and ported to PS5 by TheFloW.

Exploit Implementation

Patched

Yes in PS5 FW 5.00. Invulnerable in PS5 FW 2.50 and below.

FW <= 4.03 - exFAT driver heap-based buffer overflow

Credits

Discovered by TheFloW. Disclosed by ChendoChap.

Exploit Implementation

Not yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if the offsets in the kernel ROP chain are bad it creates a kernel panic.

See the PS4 wiki.

Patched

Yes in PS5 FW 4.50.

SMAP bypass (CVE-2021-29628)

See also [8].

Credits

  • Discovered and disclosed publicly by m00nbsd. Disclosed to SIE on 2020-12-01.

Analysis

Bug Description

A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP does not come from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.

Patched

Yes in PS5 FW 2.30 or later according to dates.

Secure Kernel

Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel

See [9].

Potentially vulnerable on PS5 FWs <= 4.03.

Secure Loader

Symmetric PS5 root keys dump by software exploit by Fail0verflow

See Fail0verflow's announcement on Twitter (2021-11-08)

Fail0verflow either has a bootrom execution exploit or an AMD/ARM PSP hack.

This allows to decrypt on PC most parts of the PS5 System Software files including:

  • PUP
  • secure loader (?AMD? ARM Platform Security Processor module) of Oberon

And by derivation, mostly like on PS Vita:

  • secure modules
  • kernel boot loader / BIOS
  • non-secure kernel
  • usermode system modules

Potentially unpatched.

Hardware

Nothing yet.

Retrieved from "http://www.psdevwiki.com/ps5/index.php?title=Vulnerabilities&oldid=2559"