Difference between revisions of "Bugs & Vulnerabilities"

From PlayStation 5 Dev Wiki
Jump to navigation Jump to search
(Added info about SMAP bypass)
Line 1: Line 1:
 +
= Usermode =
  
Modal Browser:
+
== TheFloW's usermode exploit ==
# It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel- the browser will just display that response. the downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but its useful for directing the browser anywhere you want.
 
  
SMAP bypass:
+
We have no information on this such as which usermode module it exploits.
# There is a vulnerability in FreeBSD 12 that allows SMAP to be bypassed by userland. There is a very high probability that it affects the PS5 but it was not confirmed yet. [https://hackerone.com/reports/1048322 Source].
+
 
 +
See [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)].
 +
 
 +
Potentially unpatched.
 +
 
 +
== WebKit exploits ==
 +
 
 +
WebKit exploits are harder to make and do not even give arbitrary RW because of PS5 memory protections.
 +
 
 +
=== Modal Browser HTTPS Bypass ===
 +
 
 +
* It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want.
 +
 
 +
=== FW 9.00-9.03 - WebCore::CSSFontFaceSet vulnerabilities leading to addrof/fakeobj ===
 +
 
 +
Contrarly to PS4, on PS5 this exploit does not allow arbitrary RW because of PS5memory protections.
 +
 
 +
See [https://www.psdevwiki.com/ps4/Working_Exploits#FW_9.00-9.03_-_WebCore::CSSFontFaceSet_vulnerabilities_leading_to_arbitrary_RW].
 +
 
 +
== Game savedata exploits ==
 +
 
 +
Nothing yet.
 +
 
 +
== PS4 emulator exploits ==
 +
 
 +
Nothing yet.
 +
 
 +
= Kernel =
 +
 
 +
== <= 4.50 - exFAT driver OOB ==
 +
 
 +
Not yet exploited because no public usermode exploit has been released yet.
 +
 
 +
See [https://www.psdevwiki.com/ps4/Working_Exploits#FW_.3C.3D_9.00_-_exFAT_driver_OOB]
 +
 
 +
Not yet patched.
 +
 
 +
== TheFloW's kernel exploit ==
 +
 
 +
Not released yet.
 +
 
 +
See [https://twitter.com/theflow0/status/1457362920501829636 TheFloW's PS5 kernel exploit announcement (2021-11-07)].
 +
 
 +
Potentially unpatched.
 +
 
 +
== SMAP bypass (CVE-2021-29628) ==
 +
 
 +
* Discovered and disclosed publicly by m00nbsd. Disclosed to Sony on 2020-12-01.
 +
 
 +
A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP is not coming from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.
 +
 
 +
* [https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-29628 CVE-2021-29628 (FreeBSD SMAP bypass) by m00nbsd]
 +
* [https://hackerone.com/reports/1048322 CVE-2021-29628 (PS5 SMAP bypass) by m00nbsd]
 +
 
 +
See also [https://www.psdevwiki.com/ps4/Working_Exploits#Kernel_SMAP].
 +
 
 +
Patched on PS5 FW 2.30 or later according to dates.
 +
 
 +
= Secure Kernel =
 +
 
 +
== Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel ==
 +
 
 +
See [https://www.psdevwiki.com/ps4/Bugs_%26_Vulnerabilities#Partial_SAMU_KeyRings_bruteforce_by_missing_HMAC_length_check_in_secure_kernel].
 +
 
 +
Potentially vulnerable on PS5 FWs <= 4.03.
 +
 
 +
= Secure Loader =
 +
 
 +
== Symmetric PS5 root keys dump by software exploit by Fail0verflow ==
 +
 
 +
See [https://twitter.com/fail0verflow/status/1457526453105569793 Fail0verflow's announcement on Twitter (2021-11-08)]
 +
 
 +
Fail0verflow either has a bootrom execution exploit or an AMD/ARM PSP hack.
 +
 
 +
This allows to decrypt on PC most parts of the PS5 System Software files including:
 +
* PUP
 +
* secure loader (?AMD? ARM Platform Security Processor module) of Oberon
 +
And by derivation, mostly like on PS Vita:
 +
* secure modules
 +
* kernel boot loader / BIOS
 +
* non-secure kernel
 +
* usermode system modules
 +
 
 +
Potentially unpatched.
 +
 
 +
= Hardware =
 +
 
 +
Nothing yet.

Revision as of 13:37, 21 December 2021

Usermode

TheFloW's usermode exploit

We have no information on this such as which usermode module it exploits.

See TheFloW's PS5 kernel exploit announcement (2021-11-07).

Potentially unpatched.

WebKit exploits

WebKit exploits are harder to make and do not even give arbitrary RW because of PS5 memory protections.

Modal Browser HTTPS Bypass

  • It is possible to bypass HTTPS in the modal browser, if you reply to the HTTPS CONNECT with a standard HTTP 1.1 response, instead of attempting to create a tunnel. The browser will just display that response. The downside to this is you have no idea what the contents of even the HTTP REQUEST would have been, but it is useful for directing the web browser to any website you want.

FW 9.00-9.03 - WebCore::CSSFontFaceSet vulnerabilities leading to addrof/fakeobj

Contrarly to PS4, on PS5 this exploit does not allow arbitrary RW because of PS5memory protections.

See [1].

Game savedata exploits

Nothing yet.

PS4 emulator exploits

Nothing yet.

Kernel

<= 4.50 - exFAT driver OOB

Not yet exploited because no public usermode exploit has been released yet.

See [2]

Not yet patched.

TheFloW's kernel exploit

Not released yet.

See TheFloW's PS5 kernel exploit announcement (2021-11-07).

Potentially unpatched.

SMAP bypass (CVE-2021-29628)

  • Discovered and disclosed publicly by m00nbsd. Disclosed to Sony on 2020-12-01.

A SMAP bypass has been found by m00nbsd while working on FreeBSD 12. It is named CVE-2021-29628 and affects FreeBSD 12.2 and later (til it was patched). It does not work on PS4 because PS4 kernel is based on FreeBSD 9 which did not contain the vulnerability and because PS4 SMAP is not coming from FreeBSD but is custom from Sony. It used to work on PS5 before it was disclosed and patched.

See also [3].

Patched on PS5 FW 2.30 or later according to dates.

Secure Kernel

Untested: Partial SAMU KeyRings bruteforce by missing HMAC length check in secure kernel

See [4].

Potentially vulnerable on PS5 FWs <= 4.03.

Secure Loader

Symmetric PS5 root keys dump by software exploit by Fail0verflow

See Fail0verflow's announcement on Twitter (2021-11-08)

Fail0verflow either has a bootrom execution exploit or an AMD/ARM PSP hack.

This allows to decrypt on PC most parts of the PS5 System Software files including:

  • PUP
  • secure loader (?AMD? ARM Platform Security Processor module) of Oberon

And by derivation, mostly like on PS Vita:

  • secure modules
  • kernel boot loader / BIOS
  • non-secure kernel
  • usermode system modules

Potentially unpatched.

Hardware

Nothing yet.