Exploit Chains

This page presents a compilation of exploit chains that utilize various Vulnerabilities identified on the PS5. It outlines the current functionalities of different potential and complete exploit chains for specific firmware versions.

Firmware Version	Hypervisor Exploit	Kernel Exploit	Usermode Exploit	Exploit Chain Implementation	Capability
<=2.50	Rumored [1]	Unknown	Rumored: PS4 Game Save	Unreleased by Flatz	Full Access to the system
<=4.03	N/A	exFAT Driver Heap Exploit There is no implementation because of the difficulty in writing the exploit without a real-time kernel dump or at least kASLR defeat. The proof of concept is a kernel panic when plugging in the drive and using the console for about a minute.	any usermode exploit	N/A (PS4 uses pOOBs4 by ChendoChap)	N/A
3.00-4.51	N/A	IPV6_2292PKTOPTIONS UaF (CVE-2020-7457)	WebKit loadInSameDocument	need to mix Cryptogenic's Implementation and PsFree implementation by abc	Elf Loader
3.00-4.51	N/A	IPV6_2292PKTOPTIONS UaF (CVE-2020-7457)	WebKit CSSFontFaceSet	Cryptogenic's Implementation	Elf Loader
3.00-4.51	N/A	IPV6_2292PKTOPTIONS UaF (CVE-2020-7457)	BD-JB	ps5-invoke-native by john-tornblom, bd-jb by TheFloW	Native code execution within Blu-ray context Here are some functions by john-tornblom
1.00-5.50	N/A	umtx UaF	WebKit loadInSameDocument	N/A	Elf Loader
6.00-7.61	N/A	umtx UaF	WebKit clobberWorld or unknown heap and string overflow	N/A	Elf Loader
1.00-7.61	N/A	umtx UaF	BD-JB2	N/A	Native code execution within Blu-ray context