One of the PlayStation scene's most notable figures, TheFlow (Andy Nguyen), is back at it again. He's discovered a major exploit that affects not just one PlayStation console, but three. A hackerone report by TheFlow sheds light on five vulnerabilities that range in effectiveness, allowing users to load payloads that can be used to exploit the PlayStation 3, PlayStation 4, and even the PlayStation 5. The exploit is referred to as bd-jb, or the Blu-ray Disc Java Sandbox Escape, and was featured during a panel at this year's hardwear.io security conference.

Below are 5 vulnerabilities chained together that allows an attacker to gain JIT capabilities and execute arbitrary payloads. The provided payload triggers a buffer overflow that causes a kernel panic. Please consider each of the vulnerabilities individually. AFAIK, this is the first exploit chain that is being submitted to you

According to Nguyen's report, a UDF driver can cause an overflow on both the PS4 and the PS5. An exploit chain, aka bd-jb, can then be loaded as the payload as a burned Blu-ray disc. The hack, in summary, will allow users to burn physical discs of game backups, and then play them on their consoles. This affects PlayStation 4 consoles below OFW 9.50, and PlayStation 5 systems that are below OFW 5.0.

With these vulnerabilities, it is possible to ship pirated games on bluray discs. That is possible even without a kernel exploit as we have JIT capabilities.

bd-jb: Blu-ray Disc Java Sandbox Escape affecting PS3, PS4, PS5. My talk at @hardwear_io will be uploaded in a few weeks. #hardwear_io https://t.co/gVs03Ie46q

— Andy Nguyen (@theflow0) June 10, 2022

TheFlow's panel that discusses the exploit in detail will be uploaded in "a few weeks". The full hackerone report and all of its technical details can be read about below.

Following the initial report, TheFlow made an update to his claims.

I wanted to clarify: Without a kernel exploit, you won't be able to run any pirated games (which would have worked on the PS4 only anyways), because we don't have enough RAM in the bd-j process and there are some other constraints. It was only a theoretical impact.

— Andy Nguyen (@theflow0) June 11, 2022

Source

 

[godreborn]

wololo reported the following:

"Although this is technically not a kernel exploit, this series of exploits is enough to do significant damage: TheFloW concludes his report stating that shipping pirated discs on the PS5 becomes a possibility. The discs would include the vulnerability and load a pirated copy of the game. On PS4, he states that kernel exploitation (therefore a jailbreak) becomes trivial with this series of exploit.

PS5/PS4:

• With these vulnerabilities, it is possible to ship pirated games on bluray discs. That is possible even without a kernel exploit as we have JIT capabilities."

so i honestly dont know what to think right now.

yeah, it is confusing. at first, it says that burned discs work, but then theflow0 says that there's not enough ram to allow discs to run, that it would only work with the ps4, and that a kernel exploit is needed anyway. I think this is a proof of concept thing that it might not be able to do what most people want right now, but it will work in the future given exploits are found to work in concert.

 

[Nakamichi]

@godreborn Definitely excited to see what may come in the future!
I would love plugins and homebrew akin to what we saw on the vita.
Those hacks really gave a second life to that little handheld.
I hope it can do the same for the ps5.

 

[godreborn]

@godreborn Definitely excited to see what may come in the future!
I would love plugins and homebrew akin to what we saw on the vita.
Those hacks really gave a second life to that little handheld.
I hope it can do the same for the ps5.

I mainly wanted some way to backup ps5 saves, since you can't save them to usb. that's the only thing I care about, but I'm not hacking my system at all. I don't play any games when I exploit any system, and I got tired of that.

 

[Nakamichi]

@godreborn imagine toold and plugins like on the vita tho!
there are tools where you can modify resolution and framerate limits on games there.

Now, if we could do the same for PS5 we could unlock games like Bloodborne. 60fps at 4k with the full power of a PS5 at its disposal!

I would be so happy if that came to pass. Seeing my old PS4 games with improved graphics would blow my mind.

 

[godreborn]

@godreborn imagine toold and plugins like on the vita tho!
there are tools where you can modify resolution and framerate limits on games there.

Now, if we could do the same for PS5 we could unlock games like Bloodborne. 60fps at 4k with the full power of a PS5 at its disposal!

I would be so happy if that came to pass. Seeing my old PS4 games with improved graphics would blow my mind.

a lot of these games won't really show any improvement, since they're not designed to capture the ps5's capabilities, otherwise there would no reason to have ps5 versions of the same game. like loading, for example, it's not instant with ps4 games on the nvme ssd like it is with ps5 ones.

 

[godreborn]

some games do have a free ps5 upgrade, but bloodborne isn't one of them. it doesn't even have a ps5 version. there's a mod to allow at least 60 fps (not 4K though) if you unself the eboot, patch, then build the package. the eboot will be fselfed by orbis. if you use liborbispkg, you'll have to fself it manually as that doesn't do it automatically. all dumped games have no encryption, but the system seems to require some sort of encryption, so we use fself, invented by hackers and devs. same is true of the ps3 and homebrew.

 

[tech3475]

I mainly wanted some way to backup ps5 saves, since you can't save them to usb. that's the only thing I care about, but I'm not hacking my system at all. I don't play any games when I exploit any system, and I got tired of that.

You can, kind of, via the backup utility:
https://www.playstation.com/en-gb/support/hardware/back-up-ps5-data-USB/

 

[Nakamichi]

I know.
I would absolutely love more control of the games settings tho.
Homebrew and CFW could bring us that.
Oh, and definitely emulation, too!

 

[godreborn]

yeah, I saw that, but I just don't want to exploit any future systems. that's why I sold my unpatched switch in January without ever exploiting it. just don't care anymore I guess.

 

[godreborn]

btw, that message was directed at @tech3475 regarding backing up ps5 saves. I'll just use cloud saving for now, because it's automatic and convenient.

 

[Valery0p]

Flying pieces of plastic, am I right?

(Actual quote from a Microsoft security talk btw)

 

[Deleted member 532471]

Awesomesauce

 

[chocoboss]

My PS5 is fully updated so I'm fu****.

Btw this Can be good for my 7.0.2 PS4

 

[godreborn]

My PS5 is fully updated so I'm fu****.

Btw this Can be good for my 7.0.2 PS4

theoretically yes, 7.02 should be fine as it's agnostic.

I'm also fully updated on the ps5, but I'm on disability and can't have more than 2 grand in my account at one time, otherwise, why give me disability. I find games a cheap way to enjoy life and spend my money. I'm Indian and I live with my parents, so aside from my phone bill, I have no expenses. I get $560/month, plus I have a $41 card that I've let my mother keep to pay for stuff.

 

[lordofcombo]

yeah still impossible to find a PS5 right now in singapore for example

Didn't know the boss is from Singapore,feel weird.

 

[stanleyopar2000]

New Firmware release on 3, 2, ...

It's likely the affected firmware was patched months ago and theFl0w is disclosing it now because Sony has patched it.

There's no way he would day 1 that shit. Especially when he is very likely the MVP of Sony's hackerone program.

this was submitted to playstation 8 months ago and a 20000 dollar bounty paid.. i would expect its already patched in newer f/ws

Exactly

I'm actually more disappointed this won't lead to a hack on newer PS4's above 9.00 so the games above that firmware can be backported.

 

[ZeroFX]

Time to consider a PS5 (disc edition), and yeah kudos to him.

 

[vvaitforme]

disc ps5 4.03 ready

 

[Deleted member 194275]

Can't wait to boot a PS5 with batocera to play PS1/PS2 games (aka the good playstation games).

 

[MarkDarkness]

Oh wow!