7 ms·

PS4-5.05-Kernel-Exploit: A fully implemented kernel exploit for the PS4

181 points by axiomdata316 8y ago

saagarjha 8y ago
> http://crack.bargains/505k/ http://crack.bargains/505k/ Sigh, of course qwertyoruiopz would choose a site like that…
- Operyl 8y ago
  Probably goes without saying ... but don’t visit this in your actual browser if you like using the back button.
yedawg 8y ago
I am so excited to test this. Praise the devs
djhworld 8y ago
Is there an explanation of what this is exploiting?
- AntiRush 8y ago
  It's a double free in bpf. Here's some slides from the author (from last week) with a more in depth explanation: http://crack.bargains/02r0.pdf http://crack.bargains/02r0.pdf
  - Aissen 8y ago
    Much more interesting than the raw code. I'd replace the link if I were a mod.
  - unwind 8y ago
    Thanks, that was a really epic read (and pretty close to line noise for me as a security-agnostic person). I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface, it's a character special device used to control the kernel's network filtering. [1] https://www.freebsd.org/cgi/man.cgi?bpf(4) https://www.freebsd.org/cgi/man.cgi?bpf(4)
    - brobinson 8y ago
      These also exist in the Linux kernel (bpf/ebpf)
      - 0xad 8y ago
        And of course also caused problems there. Check Project Zero advisories (iirc found by jhorn).
    - VectorLock 8y ago
      BPF in Linux has been expanded to let you run pieces of user supplied code in the kernel. Its moved a bit away from the original definition of raw packet filtering.
      - loeg 8y ago
        That's eBPF ("extended"). Unfortunately, "BPF" is commonly used to refer to both.
    - loeg 8y ago
      > I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface Nah, it's the Berkeley Packet Filter interface. It predates FreeBSD; just check out the HISTORY section of the manual page you linked. FreeBSD's first release was in 1993; BPF was implemented in 1990, with roots going back to 1980 (enet). https://svnweb.freebsd.org/csrg?view=revision&revision=47584 https://svnweb.freebsd.org/csrg?view=revision&revision=47584 https://svnweb.freebsd.org/csrg?view=revision&revision=47585 https://svnweb.freebsd.org/csrg?view=revision&revision=47585 (Note that the /csrg repo in FreeBSD's SVN is history of the original BSD project, pre-FreeBSD itself.) As other commenters have noted, Linux has adopted it as well. They've added a bunch of extensions in "eBPF," or extended BPF.
- IronBacon 8y ago
  There's a full explanation for the previous vulnerable FW 4.55 but the defect is the same (IIRC) as Sony properly fixed the race condition only with FW 5.50. https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md https://github.com/Cryptogenic/Exploit-Writeups/blob/master/...
  - homarp 8y ago
    and of the previous 4.05 https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md https://github.com/Cryptogenic/Exploit-Writeups/blob/master/...
kbumsik 8y ago
For me it is the first time to see a low-level exploit implementation written in JS. Is the exploit done through a PS4's web browser? Quite interesting.
- AntiRush 8y ago
  Yeah, it's pretty common on these platforms since it's a way to run code on an otherwise locked down device. A lot of console (and iphone) exploits tend to share similar webkit exploit code. This ps4 exploit uses a ROP strategy from an earlier iOS exploit. This is a pretty good overview (though from 2016) of the techniques used in the browser based exploits: http://phrack.org/papers/attacking_javascript_engines.html http://phrack.org/papers/attacking_javascript_engines.html
  - londons_explore 8y ago
    It seems nobody can properly sandbox webkit...
    - kevingadd 8y ago
      Part of the problem is that these devices tend to have custom operating systems and custom builds of webkit, both outdated or forked from outdated code. As a result they haven't benefited from the full set of security audits and improvements you get if you're running Safari on an iPhone, or Chrome on Windows. A couple PS4 attacks rely on the fact that the PS4 sandbox allows access to BPF from the content process, for example - that's an odd choice and I doubt it's one you'd see in the sandbox of a consumer web browser like Chrome or Safari on a desktop PC. It's a Sony oversight.
      - Jonnax 8y ago
        What's BPF? Quick googling and I couldn't find info on it.
        dman 8y ago
rusk 8y ago
PS4 is such an amazing device, I wish I could do more with it!
- Fnoord 8y ago
  Also its price hasn't increased compared to graphics cards (due to cryptocurrency hype).
  - ryanlol 8y ago
    I would be rather surprised if the prices of graphics cards offering similar performance as the PS4 had been significantly affected by cryptocurrency mining.
    - freeflight 8y ago
      Inflating the prices for the high-end also affects the price development of the mid to low end, because those don't exist in isolation from each other.
      - rusk 8y ago
        Unless you’re a multinational conglomerate with a contract to buy a huge amount at a particular price.
    - dwyerm 8y ago
      It isn't the graphics that impress me, so much, as the fact that my PS4 can actually send real 5.1 audio out to my home theater setup. It boggles my mind with how difficult that seems to be on my gaming PC. Sure, my PC can sling a zillion triangles per second, but it can't make one stompy robot dinosaur shake my living room the way the PS4 can.
      - edent 8y ago
        To be fair, the original XBox could do that via an optical audio port.
buildbuildbuild 8y ago
This annotated JavaScript describes the approach: https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c398342ed6499a00fce0c081f7bf1efaaef1/kernel.js https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c39...
fokinsean 8y ago
This is awesome, it reminds me of the security course I took in school where we had to smash stacks and hunt for various buffer overflow exploits. It was one of my favorite classes, but also one of the most difficult! To me this is one of the most impressive fields of CS/Software Engineering because of the skill required to understand and exploit full systems. Even though I'm a software dev, reading this makes me feel very humbled and shows how little I actually know. Thanks for the read! This is based off the below link which was posted in another comment. Much more informative than the github repo imo. http://crack.bargains/02r0.pdf http://crack.bargains/02r0.pdf
- bonyt 8y ago
  If you find that kind of thing fun, there are a bunch of free online CTF-style "wargames" that involve exploiting software with intentionally added bugs in a sandbox. Not nearly as difficult and impressive as this kind of real in-the-wild exploit, but definitely fun. http://overthewire.org/wargames/ http://overthewire.org/wargames/ https://www.wechall.net/about_wechall https://www.wechall.net/about_wechall
- KallDrexx 8y ago
  This type of stuff is also what does make me sad for not doing CS in college, cause it requires a lot of work to learn in my free time yet super interesting.
  - white-flame 8y ago
    I can guarantee you that most people who went through CS in college never had a course like that.
znpy 8y ago
Unrelated, but does anybody know the current status of GNU/Linux on the PS4 ? I am looking for some little box to replace my aging home server and the PS4 looks powerful but small enough for the job.
- aclarry 8y ago
  I wouldn't say it's entirely unrelated, my first thought when I saw the headline was "does this mean we can run unrestricted GNU/Linux on PS4 now?" ;p
- mastax 8y ago
  You can probably buy a better machine for that use case [1], unless you really want a built in Blu-ray drive or lots of memory bandwidth. [1]: https://www.pcengines.ch/apu3a4.htm https://www.pcengines.ch/apu3a4.htm
  - Fnoord 8y ago
    That machine, while great (PC Engines, their best offer, Coreboot, good value for money), is designed to be a DIY router for running e.g. OPNSense. You're probably better off with a NUC such as a Zotac or a Chinese knock off (example [1]). Why? Because given it has more horsepower and native hardware extensions for virtualization it can run VMs more efficiently. [1] https://www.gearbest.com/mini-pc/pp_1698829.html?wid=1433363 https://www.gearbest.com/mini-pc/pp_1698829.html?wid=1433363
    - mastax 8y ago
      Yes, a NUC, a miniITX PC, a commercial NAS, etc. would work. There are a lot of good options in this space. I would note that the apu2 is more or less half of a PS4, ignoring the GPU (which probably wouldn't work that well anyway?). PS4 | apu2c4 8x 1.6GHz Jaguar | 4x 1.0 GHz Jaguar 8GB GDDR5 | 4GB DDR3-1333 SATA, USB 3.0 | mSATA, SATA, USB 2.0/3.0, SD 1G Ethernet | 3x 1G Ethernet BT 2.1, WiFi N | N/A HDMI, SPDIF | N/A
- IronBacon 8y ago
yuchi 8y ago
If you want to have a good laugh without owning and exploiting your PS4… https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/master/userland.js#L410 https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/...
subless 8y ago
I wished I was smart enough to even implement half of what I just read and I am a senior getting my BA in computer information systems with my focus being networking and security :(

181 points by axiomdata316 8y ago

saagarjha 8y ago

> http://crack.bargains/505k/ http://crack.bargains/505k/ Sigh, of course qwertyoruiopz would choose a site like that…

Operyl 8y ago
Probably goes without saying ... but don’t visit this in your actual browser if you like using the back button.

yedawg 8y ago

I am so excited to test this. Praise the devs

djhworld 8y ago

Is there an explanation of what this is exploiting?

AntiRush 8y ago
It's a double free in bpf. Here's some slides from the author (from last week) with a more in depth explanation: http://crack.bargains/02r0.pdf http://crack.bargains/02r0.pdf
- Aissen 8y ago
  Much more interesting than the raw code. I'd replace the link if I were a mod.
- unwind 8y ago
  Thanks, that was a really epic read (and pretty close to line noise for me as a security-agnostic person). I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface, it's a character special device used to control the kernel's network filtering. [1] https://www.freebsd.org/cgi/man.cgi?bpf(4) https://www.freebsd.org/cgi/man.cgi?bpf(4)
  - brobinson 8y ago
    These also exist in the Linux kernel (bpf/ebpf)
    - 0xad 8y ago
      And of course also caused problems there. Check Project Zero advisories (iirc found by jhorn).
  - VectorLock 8y ago
    BPF in Linux has been expanded to let you run pieces of user supplied code in the kernel. Its moved a bit away from the original definition of raw packet filtering.
    - loeg 8y ago
      That's eBPF ("extended"). Unfortunately, "BPF" is commonly used to refer to both.
  - loeg 8y ago
    > I even had to look up "bpf", it's the FreeBSD packet filtering[1] interface Nah, it's the Berkeley Packet Filter interface. It predates FreeBSD; just check out the HISTORY section of the manual page you linked. FreeBSD's first release was in 1993; BPF was implemented in 1990, with roots going back to 1980 (enet). https://svnweb.freebsd.org/csrg?view=revision&revision=47584 https://svnweb.freebsd.org/csrg?view=revision&revision=47584 https://svnweb.freebsd.org/csrg?view=revision&revision=47585 https://svnweb.freebsd.org/csrg?view=revision&revision=47585 (Note that the /csrg repo in FreeBSD's SVN is history of the original BSD project, pre-FreeBSD itself.) As other commenters have noted, Linux has adopted it as well. They've added a bunch of extensions in "eBPF," or extended BPF.
IronBacon 8y ago
There's a full explanation for the previous vulnerable FW 4.55 but the defect is the same (IIRC) as Sony properly fixed the race condition only with FW 5.50. https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md https://github.com/Cryptogenic/Exploit-Writeups/blob/master/...
- homarp 8y ago
  and of the previous 4.05 https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md https://github.com/Cryptogenic/Exploit-Writeups/blob/master/...

kbumsik 8y ago

For me it is the first time to see a low-level exploit implementation written in JS. Is the exploit done through a PS4's web browser? Quite interesting.

AntiRush 8y ago
Yeah, it's pretty common on these platforms since it's a way to run code on an otherwise locked down device. A lot of console (and iphone) exploits tend to share similar webkit exploit code. This ps4 exploit uses a ROP strategy from an earlier iOS exploit. This is a pretty good overview (though from 2016) of the techniques used in the browser based exploits: http://phrack.org/papers/attacking_javascript_engines.html http://phrack.org/papers/attacking_javascript_engines.html
- londons_explore 8y ago
  It seems nobody can properly sandbox webkit...
  - kevingadd 8y ago
    Part of the problem is that these devices tend to have custom operating systems and custom builds of webkit, both outdated or forked from outdated code. As a result they haven't benefited from the full set of security audits and improvements you get if you're running Safari on an iPhone, or Chrome on Windows. A couple PS4 attacks rely on the fact that the PS4 sandbox allows access to BPF from the content process, for example - that's an odd choice and I doubt it's one you'd see in the sandbox of a consumer web browser like Chrome or Safari on a desktop PC. It's a Sony oversight.
    - Jonnax 8y ago
      What's BPF? Quick googling and I couldn't find info on it.
      - dman 8y ago

rusk 8y ago

PS4 is such an amazing device, I wish I could do more with it!

Fnoord 8y ago
Also its price hasn't increased compared to graphics cards (due to cryptocurrency hype).
- ryanlol 8y ago
  I would be rather surprised if the prices of graphics cards offering similar performance as the PS4 had been significantly affected by cryptocurrency mining.
  - freeflight 8y ago
    Inflating the prices for the high-end also affects the price development of the mid to low end, because those don't exist in isolation from each other.
    - rusk 8y ago
      Unless you’re a multinational conglomerate with a contract to buy a huge amount at a particular price.
  - dwyerm 8y ago
    It isn't the graphics that impress me, so much, as the fact that my PS4 can actually send real 5.1 audio out to my home theater setup. It boggles my mind with how difficult that seems to be on my gaming PC. Sure, my PC can sling a zillion triangles per second, but it can't make one stompy robot dinosaur shake my living room the way the PS4 can.
    - edent 8y ago
      To be fair, the original XBox could do that via an optical audio port.

buildbuildbuild 8y ago

This annotated JavaScript describes the approach: https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c398342ed6499a00fce0c081f7bf1efaaef1/kernel.js https://github.com/kpwn/PS4-5.05-Kernel-Exploit/blob/9e97c39...

fokinsean 8y ago

This is awesome, it reminds me of the security course I took in school where we had to smash stacks and hunt for various buffer overflow exploits. It was one of my favorite classes, but also one of the most difficult! To me this is one of the most impressive fields of CS/Software Engineering because of the skill required to understand and exploit full systems. Even though I'm a software dev, reading this makes me feel very humbled and shows how little I actually know. Thanks for the read! This is based off the below link which was posted in another comment. Much more informative than the github repo imo. http://crack.bargains/02r0.pdf http://crack.bargains/02r0.pdf

bonyt 8y ago
If you find that kind of thing fun, there are a bunch of free online CTF-style "wargames" that involve exploiting software with intentionally added bugs in a sandbox. Not nearly as difficult and impressive as this kind of real in-the-wild exploit, but definitely fun. http://overthewire.org/wargames/ http://overthewire.org/wargames/ https://www.wechall.net/about_wechall https://www.wechall.net/about_wechall
KallDrexx 8y ago
This type of stuff is also what does make me sad for not doing CS in college, cause it requires a lot of work to learn in my free time yet super interesting.
- white-flame 8y ago
  I can guarantee you that most people who went through CS in college never had a course like that.

znpy 8y ago

Unrelated, but does anybody know the current status of GNU/Linux on the PS4 ? I am looking for some little box to replace my aging home server and the PS4 looks powerful but small enough for the job.

aclarry 8y ago
I wouldn't say it's entirely unrelated, my first thought when I saw the headline was "does this mean we can run unrestricted GNU/Linux on PS4 now?" ;p
mastax 8y ago
You can probably buy a better machine for that use case [1], unless you really want a built in Blu-ray drive or lots of memory bandwidth. [1]: https://www.pcengines.ch/apu3a4.htm https://www.pcengines.ch/apu3a4.htm
- Fnoord 8y ago
  That machine, while great (PC Engines, their best offer, Coreboot, good value for money), is designed to be a DIY router for running e.g. OPNSense. You're probably better off with a NUC such as a Zotac or a Chinese knock off (example [1]). Why? Because given it has more horsepower and native hardware extensions for virtualization it can run VMs more efficiently. [1] https://www.gearbest.com/mini-pc/pp_1698829.html?wid=1433363 https://www.gearbest.com/mini-pc/pp_1698829.html?wid=1433363
  - mastax 8y ago
    Yes, a NUC, a miniITX PC, a commercial NAS, etc. would work. There are a lot of good options in this space. I would note that the apu2 is more or less half of a PS4, ignoring the GPU (which probably wouldn't work that well anyway?). PS4 | apu2c4 8x 1.6GHz Jaguar | 4x 1.0 GHz Jaguar 8GB GDDR5 | 4GB DDR3-1333 SATA, USB 3.0 | mSATA, SATA, USB 2.0/3.0, SD 1G Ethernet | 3x 1G Ethernet BT 2.1, WiFi N | N/A HDMI, SPDIF | N/A
IronBacon 8y ago

yuchi 8y ago

If you want to have a good laugh without owning and exploiting your PS4… https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/master/userland.js#L410 https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/...

subless 8y ago

I wished I was smart enough to even implement half of what I just read and I am a senior getting my BA in computer information systems with my focus being networking and security :(