PS4 GIFLIB Entry Point for User PlayStation 4 Exploit via Joona70

Earlier this week PlayStation 4 developer @joona70 let us know in the PSXHAX Shoutbox that he ran across a potential userland heap overflow 5.1.1 vulnerability in the GIFLIB library for reading and writing GIF images... as Sony's PS4 uses version 4.1.2.

While it's currently unknown if this could be an entry point in PS4 Firmware above 4.07 OFW, besides the PS4 JailBreak Status Chart and PS4 Hacking / Modding FAQ here's what we know from developer @xxmcvapourxx in summary:

• PS4 1.76 Browser Exploit > Kspoilt (Dlclose) Kernel > Fail0verflow's 3D Drivers / Patches with PS4 Kexec exploit
• PS4 3.55 Browser Exploit > Fire30 (Henkaku) > Ksploit (In Progress) > Fail0verflow Kexec exploit

Also Seedlord recently pointed out two more Webkit exploits, namely EDB-ID 40183 and EDB-ID: 40184, that may be a possible entrypoint with #1 and #3 HERE also working for him letting Webkit run out of memory.

Hopefully more information will become available at this year's PS4 Hardware & Reverse-Engineering CCC Talk which takes place on December 27th of this month with some updates HERE.

 

[AgtvAhybnmprdxc]

only 3.55

 

[B7U3 C50SS]

no i don't think so.

EDIT: Where it says 5.1.1 Vulnerability click that there's a CVE worth researching. as well as the tip that it works on 4.07 as well as the term "GIFLIB" i would look at the code.. i mean.. even i don't understand it.. >.< but still the CVE in there is:

CVE-2015-7555

i'm going to have a look now XD

 

[Jeff]

This may also be working on 4.xx as an EntryPoint. https://bugs.chromium.org/p/chromium/issues/detail?id=623378

Poc is attached you only need to rename xsl

 

[B7U3 C50SS]

This may also be working on 4.xx as an EntryPoint. https://bugs.chromium.org/p/chromium/issues/detail?id=623378

Poc is attached you only need to rename xsl

is there a CVE for that? or no.. because the PS4 Browser is FireFox.

BETTER CHECK BUGZILLA!

 

[Jeff]

is there a CVE for that? or no.. because the PS4 Browser is FireFox.

BETTER CHECK BUGZILLA!

DISCLOSURE
I contribute to libxml2 occasionally. I haven't shared details about this issue with anyone, and I don't plan to do so until it is fixed in WebKit browsers.

http://doc.dl.playstation.net/doc/ps4-oss/libxml2.html

 

[B7U3 C50SS]

DISCLOSURE
I contribute to libxml2 occasionally. I haven't shared details about this issue with anyone, and I don't plan to do so until it is fixed in WebKit browsers.

http://doc.dl.playstation.net/doc/ps4-oss/libxml2.html

You mean this? https://git.gnome.org/browse/libxml2/tag/?h=CVE-2016-3705

 

[Jeff]

No this https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5131

 

[B7U3 C50SS]

No this https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5131

Omg.. you had more than me. much more..i had the wrong page. XD way to go dude @Jeff

 

[Radio]

So both of these are potential 4.07 exploit?

Also I thought the ps4 browser was NetFront based?