PS5 14.10's kernel KASLR is broken. After more than 17 info-leak tricks failed… · @qwerty__cs · TwKit

@qwerty__cs

PS5 14.10's kernel KASLR is broken. After more than 17 info-leak tricks failed, researchers built a page-fault scanner that finds the live kernel base on a retail console in about 33 seconds and maps the whole 98 MB kernel image. The kernel moves to a new address every boot, and the scanner found it again after each reboot. Probes run in throwaway threads, so a miss doesn't crash the console. 14.10 so far: • Lua userland entry: done • GPU heap read/write: done • 39 userland module addresses: done • Kernel KASLR: done (new) • Kernel read/write: next On 14.10? Stay there.

曝光 3177 · 评论 10 · 点赞 63 · 书签 8