Hacker Vultra has shared a proof of concept of a semi-recent webkit vulnerability, which seems to impact the latest PS4 firmware 6.02.
More precisely, the bug impacts recent versions of the Webkit engine on PS4 6.00 and above, up to the 6.10 Beta. Firmwares 5.xx and below are apparently not vulnerable, possibly because their version of Webkit doesn’t have the vulnerable function.
The vulnerability itself (a bug in JSC::arrayProtoPrivateFuncConcatMemcpy) was first detailed on externalist’s github about 4 months ago. It is assigned CVE Number CVE-2018-4538, and another detailed writeup (from September) on the vulnerability and how it is exploitable in Safari can be found here.
The vulnerability has been fixed in Webkit several months ago, but it seems the patch might not have made it to the PS4 yet.
There is no doubt that Sony will ultimately bring the fix to their Webkit implementation. Additionally, user exploits such as webkit exploits are historically not useful “as is” on modern consoles*, where they are typically just used as entry points for privilege escalation (kernel exploits or Jailbreaks). Therefore, the chances of this becoming more than a proof of concept are very slim.
With that being said, if you are running on PS4 6.00 or above, you can give a try to the proof of concept by pointing your PS4 browser to https://c0rpvultra.github.io/PS4_jsc_ConcatMemcpy_POC/.
Welcome to the DCEmu Homebrew and Gaming Network. This Network of sites is owned and ran by fans of all games consoles, we post news on all the consoles we cover about hardware aspects, gaming and Homebrew. Homebrew and Emulation are software thats made using free and legal tools to play on games consoles. This Network is the only worldwide network of sites where coders can upload and post comments they deserve for all their hardwork. We have a Network that currently supports PSVita, WiiU, Nintendo Wii, Xbox360, PS3, PS2,PS1, Snes, N64, Gameboy, Nes, Xbox, Gamecube, Nintendo DS, PSP, GBA, Dreamcast, Sega Saturn,3DS, DSi, Switch, PS4, Pandora, xboxone, GP2X, iPhone, Windows Phone, iPad, Android and also Mobile Phone Emulation. When new consoles appear we will expand to cover those consoles. We also cover Theme Park News and news and reviews of Beer, cider, lager, wines and spirits.
news of their own releases and get the credit and
Please help DCEmu become stronger by posting on the forums every day and make our community larger.