Various tech enthusiasts and hackers continue to search for ways to hack the PlayStation 5 console firmware. Recently, security researcher notnotzecoxao announced work on a new project — he is developing a kernel exploit called “Prolapse,” targeting new firmware versions 14.00 and 14.10.
Previously, researchers had already learned how to hack PlayStation 5 firmware up to version 13.60. Due to the chosen name, confusion arose, so notnotzecoxao explained the naming: Lapse — for firmware up to 10.01, Relapse — up to 13.60, and the Prolapse he is developing — up to 14.10.
In addition, notnotzecoxao published a detailed post and commented on the recent PlayStation 5 firmware update to version 14.20. He explained that vulnerabilities such as TOCTOU use-after-free and double-free were fixed. Such vulnerabilities occur when the state of a resource, such as a file, changes between the time it is checked (Time-of-Check) and the time it is used (Time-of-Use).
His analysis showed that a new generation-ID check and slot validation after thread lock reset appeared:
This is a classic fix for a TOCTOU use-after-free and double-free vulnerability. When the aio_multi_delete function resets the lock to re-acquire the AIO object, another competing thread can free the corresponding slot and reallocate it. In version 14.10, this would then free the sub-objects of the object replaced by the attacker. The new generation-ID check filters out the re-used slot before memory is freed. This is the same aio_multi_delete deletion chain that the Lapse family exploited — therefore, any exploitation primitive for a [thread] race in aio_multi_delete that worked on versions up to and including 14.10 is “dead” [no longer works] on firmware 14.20.
notnotzecoxao did not specify when he plans to release a public version of the Prolapse exploit.