Category PS4 Jailbreaking       Thread starter PSXHAX       Start date Jun 3, 2019 at 8:47 AM       91,234       86            
Status
Not open for further replies.
Awhile back popular PS Vita scene developer TheFloW hinted that he'll be looking at the PS4 kernel in his H-ENcore Write-up, and today he shared on Twitter some details on a PS4 Kernel Bug discovered stating it is fxed somewhere between 5.05 and 6.20 OFW... with the PS4 Kernel Exploit 5.05 / 5.07 being the last public jailbreak currently available. :unsure:


PS4 kernel bug: sys_randomized_path could leak arbitrary amount of kernel stack:
Code:
char k_path[0x100];
int64_t max_len = fuword64(max_len_ptr);
if (path_len <= max_len) {
copyout(k_path, out_path, path_len);
} else {
copyout(k_path, out_path, max_len - 1);
}
Unfortunately fixed somewhere between 5.05 and 6.20.

:arrow: Update: TheFloW said his bug is not exploitable:

Nvm this bug is not exploitable, as copyout will simply abort if it dst+len wraps around or is higher than 0x8000000000000000. However, Sony did actually fix it by adding a max_len > 0 check, so I thought it could be abused.
From Pastebin.com:
Code:
// <6.00 bug (not exploitable) found by TheFloW, JS adaptation by CelesteBlue only useful for when we find an actual vulnerable syscall
    var try_sys_randomized_path_leak = function() {
        var mem = p.malloc(0x1000000); // allocate buffer
        alert(p.hexdump(mem, 0x500)); // display zeroed buffer
       
        var len_pointer = p.malloc(0x08); // allocate length
        p.write8(len_pointer, new int64(0, 2147483648)); // write length: 0x8000000000000000
        alert(p.hexdump(len_pointer, 8)); // display length
       
        alert(p.syscall("sys_randomized_path", 0, mem, len_pointer)); // trigger bug
        alert(p.hexdump(mem, 0x500)); // display buffer, should have been modified if success
    };
PS4 Kernel Bug Details by TheFloW, Fixed Between 5.05-6.20 OFW.jpg
 

Comments

Status
Not open for further replies.
Status
Not open for further replies.
Recent Articles
PS5 DualSense: New Wireless PlayStation 5 Game Controller Unveiled!
We've seen PS5 developer pictures of DualShock 5 (DS5) Controllers followed by the PS5 Hardware Specs, and today Sony officially unveiled images of the PS5 DualSense new wireless PlayStation 5...
Call of Duty: Modern Warfare Season 3 PS4 Exclusive Content and Trailer
Since their CoD: MW2 PS4 Campaign Remastered publisher Activision in conjunction with developer Infinity Ward announced details on the exclusive PlayStation 4 content in Modern Warfare Season 3...
Sony Reveals New PlayStation Now Games for April 2020
Joining the ranks of the latest PlayStation Now games for April 2020 are Marvel's Spider-Man, Just Cause 4 and The Golf Club 2019 for PS Now members. :cool: Below you'll find additional details...
Indie PlayStation 5 Game Soulborn Alpha Trailer by Pixelmad Studios
Proceeding the Godfall PS5 and Outriders PS5 trailers, Indie game Publisher Pixelmad Studios made available a Soulborn Alpha Trailer video of their upcoming PlayStation 5 openworld RPG adventure...
Top