optitronoffical/ps4-kernel-uaf-research-fw1352

This repository contains security research documenting a use-after-free vulnerability in the kernel of the PlayStation 4 game console, specifically on firmware version 13.52. The bug lives in a part of the operating system called kqueue, which programs use to monitor many events at once, such as when data becomes available to read from a pipe. The researchers found that when a monitored pipe is closed while the kqueue is still tracking it, the kernel can end up trying to use an internal record that has already been freed from memory. This kind of mistake can cause a system crash or, in some cases, let an attacker run code with higher privileges. The README explains the vulnerability step by step in detail. It describes how the kqueue system works on the PS4, noting that the console's operating system is based on a version of FreeBSD that Sony has modified. A key discovery is that the PS4 uses an unexpected numeric value for one event filter called EVFILT_USER, which differs from standard FreeBSD documentation. Getting this value wrong causes the registration to fail or crash, so documenting the correct value is an important part of the research. The authors attempted to exploit the vulnerability by flooding the freed memory slot with controlled knote structures in a technique called heap spraying. Their results show that the bug is real and causes kernel crashes when triggered without the spray. However, once the spray is in place, the system survives and no kernel memory pointers leak out. The EVFILT_USER structures properly initialize their fields, leaving no stale pointers behind that an attacker could abuse. The researchers conclude that full exploitation is blocked by the PS4's sandbox restrictions and kernel hardening measures. While the underlying use-after-free is confirmed, the practical path to taking over the system does not succeed from within the game environment. The full README is longer than what was shown.