News

PlayStation discloses “severe” Use-After-Free kernel vulnerability

PlayStation has disclosed a severe use-after-free vulnerability, after over three months since it was reported.

The vulnerability discovered by researcher Andy Nguyen exists in PS4 Firmware versions 7.02 and below. After constructing a demonstrable Proof of Concept (PoC) exploit, the researcher had responsibly reported the flaw to the company in March 2020.

If exploited in conjunction with a WebKit/Chromium vulnerability (such as CVE-2018-4386, in PS4 firmware versions up to 6.72), an attacker could:

  • Achieve a fully chained remote attack on a console.
  • Steal or modify user data.
  • Dump and run pirated games on the console.

“Due to missing locks in option IPV6_2292PKTOPTIONS of setsockopt , it is possible to race and free the struct ip6_pktopts buffer, while it is being handled by ip6_setpktopt,” states Nguyen in the HackerOne coordinated disclosure made public yesterday.

“This structure contains pointers (ip6po_pktinfo) that can be hijacked to obtain arbitrary kernel R/W primitives. As a consequence, it is easy to have kernel code execution. This vulnerability is reachable from WebKit sandbox and is available in the latest FW, that is 7.02,” the disclosure continues.

The researcher announced more details about the vulnerability through a Twitter thread:

Nguyen provided a sample local privilege escalation C exploit associated with this vulnerability. It can be chained with other exploits, such as that for CVE-2018-4386) to obtain remote access.

C exploit provided by the researcher for PlayStation kernel vulnerability
Source: Security Report

Nguyen has been awarded a $10,000 bounty award for finding and responsibly reporting this vulnerability.

As of April 22, 2020, the vulnerable devices were patched by PlayStation after rating this vulnerability as a high severity. Firmware versions 7.50 and above contain the fix released by the company.

Incidents like these are a great reminder of the times how even seemingly innocuous IoTs such as gaming consoles can become targets of attackers and potentially be abused by nation state actors. Keeping your devices up to date at all times is an advice not to be taken lightly.

Ax Sharma

Ax Sharma is a UK-based security researcher, journalist and TV subject matter expert experienced in malware analysis and cybercrime investigations. His areas of interest include open source software security and threat intel analysis. Frequently featured by leading media outlets like the BBC, Channel 5, Fortune, WIRED, The Register, among others, Ax is an active community member of the OWASP Foundation and the British Association of Journalists (BAJ).

Recent Posts

8 Brutal Truths About Cybersecurity I Wish I Knew

When I first got into cybersecurity, I thought it was all about hackers in hoodies…

13 hours ago

US Air Force Probes Potential SharePoint-Linked Privacy Breach

The US Air Force is investigating a “privacy-related issue” that may have exposed personally identifiable…

2 days ago

Harrods third-party breach exposes 430,000 customer records, hackers reach out

London’s iconic department store Harrods has disclosed that approximately 430,000 customer records were compromised in…

4 days ago

WestJet confirms customer ID, passports stolen in June cyberattack

WestJet confirmed that in a June 2025 cybersecurity incident, a “sophisticated, criminal third party” gained…

4 days ago

Did You Also Get a ‘Real’ Phishing Email From GitHub.com?

Imagine getting an email straight from GitHub’s own notification system: the same one you've trusted…

7 days ago

World’s Largest Supply Chain Cyber Attack… And just 5 Cents Stolen?

You probably saw the headlines: the world’s largest npm supply chain attack, chalk and debug-js…

1 week ago

This website uses cookies.