PS4 Kernel Exploit Details 'sys_dynlib_prepare_dlclose heap overflow' Published By Cturt

Cturt has today published details on his Github about a new PS4 Kernel vulnerability which he has found with the help of another well known hacker known as Qwertyoruiop aka Luca Todesco, famous for Jailbreaking iOS 9 along with other versions.

CTurt shared details about the new exploit where he explained, " I discovered a PS4 kernel vulnerability in a Sony system call a while ago, which I've recently had time to exploit, with the help of qwertyoruiop. This vulnerability was patched at a similar time to BadIRET, around firmware 2.00, so it won't give access to any later firmwares; but I wanted to exploit and publish a write-up about it anyway, in the hope that the heap primitives used may be helpful for any future PS4 kernel exploits"

https://twitter.com/CTurtE/status/689124911978278916

Cturt fully explains how the vulnerability works, and describes in great detail all methods of exploiting it. However he has made it quite clear that there will not be any fully weaponised exploit source code released.

Although no actual Jailbreak will be released by Cturt, it is only a matter of time before someone jumps on it now that all the information has been published. According to Todesco, due to Sony using a Kernel-mode dynamic linker, there is a massive attack surface.

https://twitter.com/qwertyoruiop/status/689133148978966528

The actual exploit is in the function 'sys_dynlib_prepare_dlclose' in particular the copyin call, which is favored because it is possible to control both the size and contents of the overflow. The size is important when using this heap overflow vulnerability as the page size needs to be 16KB on the PS4.

Find out more about Analysis of sys_dynlib_prepare_dlclose PS4 kernel heap overflow
here: http://cturt.github.io/dlclose-overflow.html

 

Neat wish I knew how to do this.