Join Us and become a Member for a Verified Badge on Discord to access private areas with the latest PS4 FPKGs.
PS4 Jailbreaking       Thread starter PSXHAX       Start date Feb 24, 2017 at 4:19 AM       9,475       18      
Status
Not open for further replies.
While most are still digesting the impact of #CloudBleed, @aimaim dropped by the PSXHAX Shoutbox this morning and shared news of this CVE-2017-6074 Linux Kernel DCCP double-free local root vulnerability (Proof-of-Concept by xairy) with us today! :ninja:

As was done with CVE-2016-1885, here's to hoping some more PlayStation 4 developers take a peek at it and see what possibilities (if any) it may present.

Until then, some quick observations in the PSXHAX Shoutbox from @xxmcvapourxx:
From @VultraAID:
  • that DLClose is for IPV6_RECVPKTINFO
  • nothing to do with a kernel, if i say
And a follow-up from @xxmcvapourxx:
  • no its kmalloc
  • you just need web crash find that memory
  • then find the offsets for vtable and gadgets
It was recently fixed on February 17, 2017, and to quote from the CVE-2017-6074: Linux kernel: CVE-2017-6074: DCCP double-free vulnerability (local root)

Hi, This is an announcement about CVE-2017-6074 [1] which is a double-free vulnerability I found in the Linux kernel. It can be exploited to gain kernel code execution from an unprivileged processes.

Fixed on Feb 17, 2017:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4

The oldest version that was checked is 2.6.18 (Sep 2006), which is vulnerable. However, the bug was introduced before that, probably in the first release with DCCP support (2.6.14, Oct 2005).

The kernel needs to be built with CONFIG_IP_DCCP for the vulnerability to be present. A lot of modern distributions enable this option by default.

The bug was found with syzkaller [2].

### Bug details

In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet is forcibly freed via __kfree_skb in dccp_rcv_state_process if dccp_v6_conn_request successfully returns [3].

However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb is saved to ireq->pktopts and the ref count for skb is incremented in dccp_v6_conn_request [4], so skb is still in use. Nevertheless, it still gets freed in dccp_rcv_state_process.

The fix is to call consume_skb, which accounts for skb->users, instead of doing goto discard and therefore calling __kfree_skb.

To exploit this double-free, it can be turned into a use-after-free:
Code:
//  The first free:
kfree(dccp_skb)
// Another object allocated on the same place as dccp_skb:
some_object = kmalloc()
// The second free, effectively frees some_object
kfree(dccp_skb)
As this point we have a use-after-free on some_object. An attacker can control what object that would be and overwrite it's content with arbitrary data by using some of the kernel heap spraying techniques.

If the overwritten object has any triggerable function pointers, an attacker gets to execute arbitrary code within the kernel.

I'll publish an exploit in a few days, giving people time to update. New Ubuntu kernels are out so please update as soon as possible.

### Timeline
  • 2017-02-15: Bug reported to security () kernel org
  • 2017-02-16: Patch submitted to netdev
  • 2017-02-17: Patch committed to mainline kernel
  • 2017-02-18: Notification sent to linux-distros
  • 2017-02-22: Public announcement
### Links
Thanks again to @aimaim in the Shoutbox for passing along the information this morning! :thumbup:
PS4 Dev Linux Kernel CVE-2017-6074 DCCP Double-Free Vulnerability.jpg
 

Comments

Agret

Senior Member
Contributor
Verified
Just FYI this has no effect on the PS4 as it doesn't run Linux it runs a modified version of FreeBSD and FreeBSD shares no code whatsoever with Linux so this will not help with PS4 exploits
 

Megago

French Developer ( Ps unban, PSN access, PSID )
Developer
Member
Contributor
I will never understand people who make us crap talking about firmware 3.55. This is said only in the title FW 1.76

Many developer say not to update our 1.76 console either you listen in expectation of a possible cfw or you update your ps4

Sorry for my bad english, i'm french
 

Wultra

Developer
Senior Member
Contributor
Well actually you both wrong, PS4 is pretty much based on linux, FREEBSD is Basically Linux, all they did was edit packages and sh1t on FreeBSD to make it a modified Version for ps4. And Local Root Linux Kernel Exploits will work on any Linux OS as they use Linux Kernel, unless the exploit has not been patched in later updates (FREEBSD, CENT OS, Ubuntu)

p.s: you remind me of tho short planks.
 

Kraken

Senior Member
Contributor
Linux and FreeBSD are both (mostly) POSIX compliant so they look and function very much the same and FreeBSD also contains a compatibility layer for additional Linux compatibility so it can run many Linux programs. However, under the hood they run a completely kernel and have completely different code. While it is possible that the same vulnerability exists in Linux and FreeBSD, it is rather unlikely. The PS4 runs mostly unmodified FreeBSD though, so FreeBSD vulnerabilities should be viable on PS4.

https://en.wikipedia.org/wiki/POSIX#POSIX-certified

https://en.wikipedia.org/wiki/FreeBSD
 
Status
Not open for further replies.

:fire: Latest Help Topics

Top