Hacker Announces Kernel Exploit for PlayStation 5 with Firmware Versions 14.00 and 14.10
Translated with AI from the Russian original.
Sony improves security, while specialists continue to find new approaches to hacking.
Various tech enthusiasts and hackers continue to search for ways to hack the PlayStation 5 console firmware. Recently, security researcher notnotzecoxao announced work on a new project — he is developing a kernel exploit called “Prolapse,” targeting new firmware versions 14.00 and 14.10.
Previously, researchers had already learned how to hack PlayStation 5 firmware up to version 13.60. Due to the chosen name, confusion arose, so notnotzecoxao explained the naming: Lapse — for firmware up to 10.01, Relapse — up to 13.60, and the Prolapse he is developing — up to 14.10.
In addition, notnotzecoxao published a detailed post and commented on the recent PlayStation 5 firmware update to version 14.20. He explained that vulnerabilities such as TOCTOU use-after-free and double-free were fixed. Such vulnerabilities occur when the state of a resource, such as a file, changes between the time it is checked (Time-of-Check) and the time it is used (Time-of-Use).
His analysis showed that a new generation-ID check and slot validation after thread lock reset appeared:
This is a classic fix for a TOCTOU use-after-free and double-free vulnerability. When the aio_multi_delete function resets the lock to re-acquire the AIO object, another competing thread can free the corresponding slot and reallocate it. In version 14.10, this would then free the sub-objects of the object replaced by the attacker. The new generation-ID check filters out the re-used slot before memory is freed. This is the same aio_multi_delete deletion chain that the Lapse family exploited — therefore, any exploitation primitive for a [thread] race in aio_multi_delete that worked on versions up to and including 14.10 is “dead” [no longer works] on firmware 14.20.
notnotzecoxao did not specify when he plans to release a public version of the Prolapse exploit.
Never miss our newsAdd this site to your preferred sources to see us more oftenAdd on Google
