Exploit Chains

This page presents a compilation of exploit chains that utilize various Vulnerabilities identified on the PS5. It outlines the current functionalities of different potential and complete exploit chains for specific firmware versions.

Firmware Version	Hypervisor Exploit	Kernel Exploit	Usermode Exploit	Exploit Chain Implementation	Capability
<=2.50	Rumored [1]	Unknown	Rumored: PS4 Game Save	Unreleased by Flatz	Full Access to the system
<=4.03	N/A	exFAT Driver Heap Exploit There is no implementation because of the difficulty in writing the exploit without a real-time kernel dump or at least kASLR defeat. The proof of concept is a kernel panic when plugging in the drive and using the console for about a minute.	any usermode exploit	N/A (PS4 uses pOOBs4 by ChendoChap)	N/A
3.00-4.51	N/A	IPV6_2292PKTOPTIONS Use after free (CVE-2020-7457)	WebKit loadInSameDocument	need to mix Cryptogenic's Implementation and PsFree implementation by abc	Elf Loader
3.00-4.51	N/A	IPV6_2292PKTOPTIONS Use after free (CVE-2020-7457)	WebKit CSSFontFaceSet	Cryptogenic's Implementation	Elf Loader
3.00-4.51	N/A	IPV6_2292PKTOPTIONS Use after free (CVE-2020-7457)	bd-jb by TheOfficialFlow	ps5-invoke-native by john-tornblom	Native code execution within Blu-ray context Here are some functions by john-tornblom