PS5 Kernel exploit: Flat_z implementations released, writeup on the exploit, and Firmware limitations

A lot has happened in the few days that followed a huge vulnerability disclosure in FreeBSD, which has been confirmed to impact the PS5. Specifically, implementations compatible with the PS5 are already being published, a full writeup on how to exploit the vulnerability is out there, and the bug has been apparently patched in PS5 Firmware 8.00. Read on for details.

PS5 Kernel vulnerability – most likely patched with Firmware 8.00

FreeBSD released a security advisory for a critical vulnerability in their OS. The vulnerability has been confirmed to impact the PS5, and had apparently been used, under the hood, by several hackers or hacker groups, even before the disclosure.

PlayStation hacker flat_z has stated on discord that Sony have patched the exploit with PS5 Firmware 8.00. This means all PS5 Firmwares up to 7.61 included are impacted by the vulnerability. If you have a PS5 o a low firmware, good for you. If not, now might be the best time to find one while they’re still cheap. If you go hunting for a low firmware PS5 though, do understand that as long as nothing is released, you might end up with just an expensive PS5. Best case scenario, be reminded that a hacked PS5 nowadays can only run a limited selection of homebrew, and PS4 “backups”.

It appears that Sony didn’t “purposefully” patch the exploit ages before it was even known, but rather did a significant cleanup of their code when working on Firmware 8.00, which ended up patching a significant amount of vulnerabilities. This exploit being voided with Firmware 8.00 was apparently a side effect of that. As stated by Zecoxao:

to everyone that did not understand flatz’s words: it’s likely that sony never intended to fix this bug, and accidentally “fixed” it on 8.00 by patching syscall and libkernel access from the main contenders such as bluray java, webkit and ps2 games…

— Jose Coixao (@notnotzecoxao) September 13, 2024

FreeBSD Vulnerability: Writeup on Access Vector and VM Framework by Fail0verflow

It seems multiple security researchers had discovered the vulnerability beforehand, and had kept it under wraps until now. AccessVector have a detailed writeup of the vulnerability at https://accessvector.net/2024/freebsd-umtx-privesc and stated they will release a PoC. That PoC will most likely not be PS5 specific though, but the writeup is a good starting point for anyone wanting to understand the details of the exploit.

Fail0verflow claim they’ve had access to this vulnerability for two years now, and have a good framework designed to run the exploit in a “PS5 like” FreeBSD environment. If you want to look at the implementation and run it in a VM for debugging, check out their github at https://github.com/fail0verflow/ps5-umtxdbg/ . No writeup about this exploit on their blog yet.

PS5 Exploit for Firmware 7.61 and below – Flat_z releases implementations for BD-JB and Lua

Flat_z has released two implementations of the exploit earlier today. One intended to run with the BD-JB usermode exploit (you will need a Disc-based PS5 to run this one, as well as a Blu-Ray disc burner and some writeable discs, to burn the exploit on Blu-Ray). The other one, which will be interesting in particular for those on a Digital PS5, apparently involves loading the exploit in a Lua script.

It has been hinted that some specific game on the PS Store uses Lua scripting (maybe as part of its saves or configuration), and I’m assuming you will be able to tweak the lua files of the game, in order to trigger a usermode exploit which will in return load this FreeBSD exploit. This system will most likely work like Mast1c0re, meaning you will need a way to decrypt/encrypt these files from and to your PS5. The known ways to do that currently are to used a hacked PS4 (or ask someone with a hacked PS4 to do it for you), and/or to use a service such as Save Wizard (this is a paid-for service that I have never used so I can’t personally vouch for it.).

It will most likely be impossible to actually purchase and install the exploitable game while fulfilling the requirement of being on firmware 7.61 or below. This means people on a Digital edition of the PS5 will either need to be extremely lucky (aka already own the game in question, or a game will similar exploits), or wait for a new entry point (e.g. webkit) at the moment. It’s also very likely that Mast1c0re could be leveraged to run the exploit here as well, given time. So if you jumped aboard the mast1c0re exploit back in the day and own Okage: Shadow King on your PS5, I would assume something might come your way eventually.

Download PS5 exploit implementations by flat_z

• BD-JB implementation
• LUA implementation

(source)
Note: These implementations do nothing on their own: they need respectively to compiled within the BD-JB framework, or encrypted and run within a yet-to-be-announced game

Flat_Z has also stated the exploit is neither a usermode not a kernel exploit, and at this point I’m personally confused as to what that technically means. I’ve always assumed an exploit either gives you an entry point (lets you inject malicious data as a regular user, aka usermode exploit), or lets you do privilege escalation (aka kernel exploit) , but it seems I’m too old for the new world of computer security.   Update: that specific point was about another vulnerability, recently disclosed to Sony by TheFloW, and not related to the exploit discussed in this article. My apologies for the confusion.

Again, at this point, if you happen to have a PS5 on firmware 7.61 or below, stay put. You can test the releases above if you’re technically savvy, but otherwise we’re still in waiting mode.