[Scene] libxml2: Posible nueva vulnerabilidad en PS4/PSVita? en PlayStation 4

egarrote 07 may 2016 10:15 *

Erizo Sónico

12.114 mensajes
desde ene 2006
en Studiopolis Zone

Editado 2 veces. Última: 7/05/2016 - 10:18:41 por egarrote.

Descubierta nueva vulnerabilidad para PS4:

libxml2 vulnerability, a new hack vector for Vita and PS4?

Scene member Dragood2 dropped by our forums recently to point a new vulnerability in libxml2, an open source XML processing library.
The interesting part for readers of this blog is that libxml2 is a library used both on the PS4 and the PS Vita. An exploitable vulnerability in the library could potentially be ported to these consoles.

I was expecting the forum thread would generate lots of replies but it hasn’t received the attention it deserves so far. The vulnerability is fresh, so it is most likely present on the PS4 and the PS Vita. The question of course, is if this could lead to an exploit or not.

"A couple of weeks back while working on a related bug [CVE-2016-3627] I discovered a specially created xml file is capable of triggering a stack overflow before libxml2 can detect its a invalid xml file."

The vulnerability triggers a stack overflow, and now has its own CVE: CVE-2016-3705.

For the PS4, CTurt has confirmed to me that FreeBSD has had Stack Protector baked in since FreeBSD 8.0, meaning that this vulnerability (if confirmed on PS4) would be useless on its own (Unless some other exploit could help bypass stack protection?).

Status of the vulnerability on the PS Vita is unknown so far and I don’t think anyone has tested. I do not know if the PS Vita’s firmware has some sort of stack protection implemented. Given that the PS Vita has been a tough nut to crack with pretty advanced security, it wouldn’t be surprising, but it would be great if Vita experts could chime in.
Fuente

Según cuenta Wololo, esta nueva vulnerabilidad estaría basada en una librería xml de la que hacen uso tanto PS4 como PSVita, en la consola de sobremesa es mas que probable que ya este corregida, pero para la portátil ni tan si quiera ha sido probada, y se necesita comprobar si puede llegar a ser un sitio por donde meterle mano:

In order to test, someone would need to confirm if the test file (provided in the source link below) actually crashes the PS Vita (or the PS4) when accessed. To access such an XML file, one might have to use a proxy such as SKFU Pr0xy in order to trick the console and download the test file instead of one of the regular XML files it uses, for example to check for firmware update.
There’s some test work to be done here, but nothing fundamentally hard.

Normally I would not blog about this in such early stages, when nothing’s been confirmed, but I think this needs some visibility, and people with time+skills to confirm if something can be done with this.

Source: oss-sec mailing list, via dragood2 on /talk (repro xml file in the bugzilla link)

Para probarlo, se necesita confirmar que utilizando el archivo xml se cuelga la consola cuando trate de leerlo. Para hacerlo es necesario utilizar un proxy como el SKFU Pr0xy para engañar a la consola y tratar de descargar el xml en vez de los xml originales utilizados por ejemplo para comprobar las actualizaciones de firmware.

Salu2!