One of the PlayStation scene's most notable figures, TheFlow (Andy Nguyen), is back at it again. He's discovered a major exploit that affects not just one PlayStation console, but three. A hackerone report by TheFlow sheds light on five vulnerabilities that range in effectiveness, allowing users to load payloads that can be used to exploit the PlayStation 3, PlayStation 4, and even the PlayStation 5. The exploit is referred to as bd-jb, or the Blu-ray Disc Java Sandbox Escape, and was featured during a panel at this year's hardwear.io security conference.

Below are 5 vulnerabilities chained together that allows an attacker to gain JIT capabilities and execute arbitrary payloads. The provided payload triggers a buffer overflow that causes a kernel panic. Please consider each of the vulnerabilities individually. AFAIK, this is the first exploit chain that is being submitted to you

According to Nguyen's report, a UDF driver can cause an overflow on both the PS4 and the PS5. An exploit chain, aka bd-jb, can then be loaded as the payload as a burned Blu-ray disc. The hack, in summary, will allow users to burn physical discs of game backups, and then play them on their consoles. This affects PlayStation 4 consoles below OFW 9.50, and PlayStation 5 systems that are below OFW 5.0.

With these vulnerabilities, it is possible to ship pirated games on bluray discs. That is possible even without a kernel exploit as we have JIT capabilities.

bd-jb: Blu-ray Disc Java Sandbox Escape affecting PS3, PS4, PS5. My talk at @hardwear_io will be uploaded in a few weeks. #hardwear_io https://t.co/gVs03Ie46q

— Andy Nguyen (@theflow0) June 10, 2022

TheFlow's panel that discusses the exploit in detail will be uploaded in "a few weeks". The full hackerone report and all of its technical details can be read about below.

Following the initial report, TheFlow made an update to his claims.

I wanted to clarify: Without a kernel exploit, you won't be able to run any pirated games (which would have worked on the PS4 only anyways), because we don't have enough RAM in the bd-j process and there are some other constraints. It was only a theoretical impact.

— Andy Nguyen (@theflow0) June 11, 2022

Source

 

[godreborn]

I only have the highest tier becasue I had 2 more years stacked and got in on the PS Now upgdade deal before they closed the loophole. I will have to see where everything stands in two years to see if I'll continue with Premium or not. I still have my modded PS3 so the PS3 streaming isn't a factor to me personally. Sucks you have a data cap. Aren't the PS1 and PS2 games downloadable?

I think there's downloads and streaming for ps1 and 2. I don't play the system enough to warrant paying for it though. having issues with xbox remote play, so I bought the premium game pass thinking I needed an online service. that didn't fix the problem, so I'll probably request a refund. I don't play that system very much either, since I don't play new games that often (only in the mornings like 4-9 or somewhere in there in the a.m. after waking up). the main reason I have psn+ or even nso is cloud saving. my first switch died of nand corruption, and it was legit. that was about a month into nso. I still haven't gotten to the same point in octopath traveler or xenoblade chronicles 2. both games are pretty hard, so it sucks starting over. anyway, I bought nso immediately and vowed never to let that happen again. cloud saving is free on xbox.

 

[alt_Human]

I think there's downloads and streaming for ps1 and 2. I don't play the system enough to warrant paying for it though. having issues with xbox remote play, so I bought the premium game pass thinking I needed an online service. that didn't fix the problem, so I'll probably request a refund. I don't play that system very much either, since I don't play new games that often (only in the mornings like 4-9 or somewhere in there in the a.m. after waking up). the main reason I have psn+ or even nso is cloud saving. my first switch died of nand corruption, and it was legit. that was about a month into nso. I still haven't gotten to the same point in octopath traveler or xenoblade chronicles 2. both games are pretty hard, so it sucks starting over. anyway, I bought nso immediately and vowed never to let that happen again. cloud saving is free on xbox.

If it helps any, I lost my complete AC island becasue when I sold my Switch to get the AC edition, I didn't know the island backup was something you had to actually go into the settings to enable and wasn't on by defualt when they added it.

 

[subcon959]

I'm not interested in hacking my PS5, but I love reading about stuff like this. TheFlow is the only reason I still enjoy my Vita.

 

[godreborn]

I'm not interested in hacking my PS5, but I love reading about stuff like this. TheFlow is the only reason I still enjoy my Vita.

same for me, but I only played the vita when it wasn't acted. I had tales of hearts r and ys memories of celceta, borderlands 2, and maybe another few games. I bought celceta for the ps4 on the 5, since I'm a huge fan of that series, but that limited edition version on the vita/maybe ps4 is insane.

 

[subcon959]

same for me, but I only played the vita when it wasn't acted. I had tales of hearts r and ys memories of celceta, borderlands 2, and maybe another few games. I bought celceta for the ps4 on the 5, since I'm a huge fan of that series, but that limited edition version on the vita/maybe ps4 is insane.

There's a very nice PS5 limited edition release of Lacrimosa of Dana coming later this year.

 

[godreborn]

There's a very nice PS5 limited edition release of Lacrimosa of Dana coming later this year.

I might get it. I bought and beat the game twice on the switch. it was only twice since my first switch died inexplicably. I heard that falcom is going to give info on ys x later on this month. that's what I found in my phone anyway.

 

[ImSoHandsome]

Welp Blue ray drives are either 25gb or 50gb(super expensive). What games will fit there?

 

[magico29]

Main disc edition PS5 FW 2.30 plus 2 Forbidden West PS5 bundle.( Factory sealed)

 

[godreborn]

Welp Blue ray drives are either 25gb or 50gb(super expensive). What games will fit there?

not sure, but the ps5 doesn't even read from the disc. the disc just serves as the license as the game will not run until being copied to the nvme ssd. and, based on my experience, is very few games. I actually had to delete my copied games for games I wasn't playing at the time. I had stored them on the external hdd, but they will not run from there, and the system will try to copy the game again even if it's already stored there. they have to be on the internal ssd, which is about 670GBs free. plus, the expansion slot devices are very expensive.

 

[smf]

This is probably making Sony sweat, but you know what's really stupid? Dedicated security researchers like the flow would probably not be spending so much time and effort trying to exploit these consoles if Sony just opened it up and let people run homebrew straight up.

Burglars also won't spend time breaking into your house, if you leave all your valuables on the front lawn

 

[goncalodoom]

You woudn't be able to run most PS5 games since the bandwith of the disc drive is way too slow compared to a regular HDD, nevermind the SSD ... Just imagine the stuttering and the mess on texture streaming

 

[LightBeam]

So you could just burn discs like on PS2 ? Haha that's so old school I love it

 

[pwsincd]

this was submitted to playstation 8 months ago and a 20000 dollar bounty paid.. i would expect its already patched in newer f/ws

 

[godreborn]

8 months sounds about right for when that firmware was released or around that time. the exploit was likely discovered on a lower firmware, then a kernel dump was used to determine if it worked on later firmwares. 4.50 might've been the latest at the time, but it was likely tested on 5.00 where it failed.

 

[Bladexdsl]

BUYING A PS5 ASAP

good luck finding one that isn't a scalper

 

[godreborn]

remember guys, theflow0 has already stated that this will not work with games due to ram limitations, plus it would only work with the ps4, which needs a kernel exploit. it's more a poc exploit that may be useful in the future, just not right now.

 

[godreborn]

As normal! But it do seem that PS4s can boot fixed disks

I'm kinda glad, because at least let the system get some games. I only own one ps5 exclusive game, and that's ratchet and clank. 90% of its library is ps4 games. though, near instant loading is always desirable, which is why I usually buy the ps5 version of games, even if there's a ps4 version with a free upgrade. I figure I'll never play the ps4 version, and the trophies thing with the ps4 and 5 is a complete mess, some transfer over one way, others both ways, some not at all. wtf!? sony.

 

[Bladexdsl]

for this to work you need the uber expensive 100GB blank brd most ps5 games are this (good luck burning horizon without one) which at the moment you can only get from japan so add import tax too. might as well just buy the damn game disc!

 

[godreborn]

I think horizon might be one of my bigger games, that and final fantasy vii remake, each is about 70-80GBs. the ps5 will not allow you to run the game from a disc either as it's too slow. it always verifies the disc when you come back from rest mode (you can hear the disc drive spinning), then it's silent. anyway, it copies the game to the nvme ssd, which is very small considering the size of some of these games. you might be able to fit 8-10 games on it at once, so it can't be frustrating waiting forty minutes for a game to copy, and having to do that over and over again.

 

[Nakamichi]

wololo reported the following:

"Although this is technically not a kernel exploit, this series of exploits is enough to do significant damage: TheFloW concludes his report stating that shipping pirated discs on the PS5 becomes a possibility. The discs would include the vulnerability and load a pirated copy of the game. On PS4, he states that kernel exploitation (therefore a jailbreak) becomes trivial with this series of exploit.

PS5/PS4:

• With these vulnerabilities, it is possible to ship pirated games on bluray discs. That is possible even without a kernel exploit as we have JIT capabilities."

so i honestly dont know what to think right now.