Vulnerabilities: Difference between revisions
CelesteBlue (talk | contribs) No edit summary |
CelesteBlue (talk | contribs) No edit summary |
||
| (5 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
= Usermode = | = Usermode = | ||
== | == BD-J exploits == | ||
=== FW <=4.51 - Five vulnerabilities chained by TheFloW === | |||
See [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)]. | See [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)]. | ||
To wikify using PS4 wiki page. | |||
== WebKit exploits == | == WebKit exploits == | ||
| Line 17: | Line 17: | ||
* It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want. | * It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want. | ||
=== FW | === FW 3.00-4.50 - WebCore::CSSFontFaceSet vulnerabilities leading to addrof/fakeobj === | ||
Contrarly to PS4, on PS5 this exploit does not allow arbitrary RW because of | Contrarly to PS4, on PS5 this exploit does not allow arbitrary RW because of PS5 memory protections. | ||
See [https://www.psdevwiki.com/ps4/Working_Exploits#FW_9.00-9.03_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW]. | See [https://www.psdevwiki.com/ps4/Working_Exploits#FW_9.00-9.03_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW]. | ||
Tested working on PS4 FWs 9.00-9.03 and PS5 FWs 3.00-4.50. Untested: PS5 FWs 2.10-2.50. | |||
Unpatched as of PS5 FW 4.50. | |||
== Game savedata exploits == | == Game savedata exploits == | ||
| Line 33: | Line 37: | ||
= Kernel = | = Kernel = | ||
== <= 4. | == FW <= 4.03 - exFAT driver OOB == | ||
Not yet | Not exploited yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if offsets are bad it creates a kernel panic. | ||
See [https://www.psdevwiki.com/ps4/Working_Exploits#FW_.3C.3D_9.00_-_exFAT_driver_OOB] | See [https://www.psdevwiki.com/ps4/Working_Exploits#FW_.3C.3D_9.00_-_exFAT_driver_OOB] | ||
Patched on PS5 FW 4.50. | |||
== TheFloW's kernel exploit == | == TheFloW's kernel exploit == | ||
Revision as of 20:46, 23 June 2022
Usermode
BD-J exploits
FW <=4.51 - Five vulnerabilities chained by TheFloW
See TheFloW's PS5 kernel exploit announcement (2021-11-07).
To wikify using PS4 wiki page.
WebKit exploits
WebKit exploits are harder to make and do not even give arbitrary RW because of PS5 memory protections.
Modal Browser HTTPS Bypass
- It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want.
FW 3.00-4.50 - WebCore::CSSFontFaceSet vulnerabilities leading to addrof/fakeobj
Contrarly to PS4, on PS5 this exploit does not allow arbitrary RW because of PS5 memory protections.
See [1].
Tested working on PS4 FWs 9.00-9.03 and PS5 FWs 3.00-4.50. Untested: PS5 FWs 2.10-2.50.
Unpatched as of PS5 FW 4.50.
Game savedata exploits
Nothing yet.
PS4 emulator exploits
Nothing yet.
Kernel
FW <= 4.03 - exFAT driver OOB
Not exploited yet because even though there is ChendoChap's method to execute usermode code in WebKit, there is no PS5 kernel dump to build a kernel ROP chain. Exploiting this kernel vulnerability blind is almost impossible because once the USB device is inserted it corrupts the kernel heap memory and if offsets are bad it creates a kernel panic.
See [2]
Patched on PS5 FW 4.50.
TheFloW's kernel exploit
Not released yet.
See TheFloW's PS5 kernel exploit announcement (2021-11-07).
Potentially unpatched.
SMAP bypass (CVE-2021-29628)
- Discovered and disclosed publicly by m00nbsd. Disclosed to Sony on 2020-12-01.
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP is not coming from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.
See also [3].
Patched on PS5 FW 2.30 or later according to dates.
Secure Kernel
Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel
See [4].
Potentially vulnerable on PS5 FWs <= 4.03.
Secure Loader
Symmetric PS5 root keys dump by software exploit by Fail0verflow
See Fail0verflow's announcement on Twitter (2021-11-08)
Fail0verflow either has a bootrom execution exploit or an AMD/ARM PSP hack.
This allows to decrypt on PC most parts of the PS5 System Software files including:
- PUP
- secure loader (?AMD? ARM Platform Security Processor module) of Oberon
And by derivation, mostly like on PS Vita:
- secure modules
- kernel boot loader / BIOS
- non-secure kernel
- usermode system modules
Potentially unpatched.
Hardware
Nothing yet.