PlayStation discloses “severe” kernel vulnerability
Published: 2020-07-07 07:11:48

PlayStation has disclosed a severe use-after-free vulnerability, after over three months since it was reported.

The vulnerability discovered by researcher [Andy Nguyen](https://twitter.com/theflow0) exists in PS4 Firmware versions 7.02 and below. After constructing a demonstrable Proof of Concept (PoC) exploit, the researcher had responsibly reported the flaw to the company in March 2020.

If exploited in conjunction with a WebKit/Chromium vulnerability (such as [CVE-2018-4386](https://bugs.chromium.org/p/project-zero/issues/detail?id=1665), in PS4 firmware versions up to [6.72](https://twitter.com/theflow0/status/1280230221942272000)), an attacker could:

-   Achieve a fully chained remote attack on a console.
-   Steal or modify user data.
-   Dump and run pirated games on the console.

“Due to missing locks in option *IPV6\_2292PKTOPTIONS* of *setsockopt* , it is possible to race and free the struct *ip6\_pktopts* buffer, while it is being handled by *ip6\_setpktopt*,” states Nguyen in the [HackerOne](https://hackerone.com/reports/826026) coordinated disclosure made public yesterday.

“This structure contains pointers (*ip6po\_pktinfo*) that can be hijacked to obtain arbitrary kernel R/W primitives. As a consequence, it is easy to have kernel code execution. This vulnerability is reachable from WebKit sandbox and is available in the latest FW, that is 7.02,” the disclosure continues.

The researcher announced more details about the vulnerability through a Twitter thread:

<blockquote class="twitter-tweet"><p lang="en" dir="ltr">Here you are, <a href="https://t.co/cdVyvdqGZ6">https://t.co/cdVyvdqGZ6</a>, PS4 kernel exploit for FW 7.02 and below. Vulnerability discovered on 2019-06-09.<br><br>This must be chained together with a WebKit exploit, for example <a href="https://t.co/1BYe1aFGCe">https://t.co/1BYe1aFGCe</a> for FW 6.50.</p>&mdash; Andy Nguyen (@theflow0) <a href="https://twitter.com/theflow0/status/1280224554393178122?ref_src=twsrc%5Etfw">July 6, 2020</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

Nguyen provided a sample local privilege escalation [C exploit](https://hackerone-us-west-2-production-attachments.s3.us-west-2.amazonaws.com/Y13EyQCGKEqxH8PpJgFKh5uY?response-content-disposition=attachment%3B%20filename%3D%22exploit.c%22%3B%20filename%2A%3DUTF-8%27%27exploit.c&response-content-type=text%2Fx-c%2B%2Bsrc&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=ASIAQGK6FURQS6MVL25M%2F20200707%2Fus-west-2%2Fs3%2Faws4_request&X-Amz-Date=20200707T063623Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEDYaCXVzLXdlc3QtMiJHMEUCIQDeLFpCuSFWSxHaH9lnzhcwBfL%2ByJWC70j8dROryvGTmQIgSJHhG%2FYN5AbOGgSFidR5%2FbG6IqmJudMtvv3FzaIKpc8qvQMIz%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARABGgwwMTM2MTkyNzQ4NDkiDEi5muqGRBsOHRuGgyqRA%2FmoKrSvBYHMCkbugcsiFE7iZS2WyeRReetKLa6MG%2FT8sZfvXqfQhWjWnam25h4VXcJkMPqEsY863S7nAj%2F%2FsbZixJPuzZRJqra7S52%2F4YCIMTiVEQXKA9bnEpf4e%2B59vThsmwVDqZOCi8jgXWCv5w1WkmYWju%2F6SNRUGUvDzO0gjrg9QidThqOy8FCNXAxfZTKMQtKwku2c6Vg6FG%2FMGf00uHaFqhywb2K2i7kZnyOdy29K2nN%2BiaWdRPrgnca%2BbBuAjO%2BxWlAVdaLSad7%2But4rQYqy%2BpOvmxorv4mgJdcmO9D2cWYdE0KFsKxc4QG6%2F6fCRVQfyWCVspQV6QeWKAWDq8Cy9WItOgRZGlukS8qWqwl%2BrD9IraJbYHodTj3ticRKmSMLR6mz4nZEWJLMgAHwKvcgjMTlaRplTQXd3kEptGKr2wdXESSKu0TUhKHsylq0MQOZH2mI4X65be7dmCo%2Bh7UzQxa%2BD%2FQRbT4SN2GomVsHvfT7u8APquKBJGmfzpAz1FoygFdGFMdXdU9Dp5JBMK%2BRkPgFOusB3MVz0CUwCwX%2F627wYnk2EqYwcKN5Yo0z0U5mOkaVN%2Ba5LV1vFS%2FaPfYNsQp9ITJPeANwTb%2Br3cUY8rB8mY7vCYfag9ZgQxkLvrRK0l1AhVZ849Wqi1MpqKbZ57iNyHNUbRtVT85h35Mj%2Be2fVOzhukQBh32BQltlj%2BqpjUcetQhnq8cAWY6l5micS25NzTo9llksYWScBTTkvOAEomrxcsjB76pjDfaMj0fXwNCflnwMxlCGh2ukDC%2FTa2RgIYobNDegrsORb4fUkdS8oNEsrXatecEjvM9pqf62aB57zk%2BllbcESqQont2%2F%2BQ%3D%3D&X-Amz-Signature=980b83b690d181a1e0c14e521ced4bc385704ede96d7480c2d79f6da4c29f120) associated with this vulnerability. It can be chained with other exploits, [such as that for CVE-2018-4386](https://github.com/Fire30/bad_hoist)) to obtain remote access.

![](https://securityreport.com/wp-content/uploads/2020/07/image-1024x705.png)

C exploit provided by the researcher for PlayStation kernel vulnerability (Source: [Security Report](https://securityreport.com/))

Nguyen has been awarded a **$10,000 **bounty award for finding and responsibly reporting this vulnerability.

As of [April 22, 2020](https://hackerone.com/reports/826026#activity-7760281), the vulnerable devices were patched by PlayStation after rating this vulnerability as a high severity. Firmware versions 7.50 and above contain the fix released by the company.

Incidents like these are a great reminder of the times how even seemingly innocuous IoTs such as gaming consoles can become targets of attackers and potentially be abused by nation state actors. Keeping your devices up to date at all times is an advice not to be taken lightly.

_Originally published on and syndicated from [Security Report](https://securityreport.com/2020/07/07/playstation-discloses-severe-use-after-free-kernel-vulnerability/)_