PS5-IPV6-Kernel-Exploit

It's a use-after-free in FontFaceCache (https://wololo.net/2021/10/14/use-after-free-webkit-vulnerab... and https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit/blob/...), not a JIT bug. Funnily enough, I think the CVE they're saying it is is wrong? The link to the project zero itw tracking page is for CVE-2021-30858 which is an IndexDB UAF, which is a completely seperate bug; the MITRE tracking page for CVE-2021-30858 just has the boilerplate "a malicious page can cause an exploit" from Apple, and doesn't say if it's for the IndexDB or FontFaceCache bug, so I think the Jailbreak people are just confused on this one.

> "This exploit achieves read/write, but not code execution. This is because we cannot currently dump kernel code for gadgets, as kernel .text pages are marked as eXecute Only Memory (XOM). Attempting to read kernel .text pointers will panic! > As per the above + the hypervisor (HV) enforcing kernel write protection, this exploit also cannot install any patches or hooks into kernel space, which means no homebrew-related code for the time being." [1] So yeah, it's not a full jailbreak yet. [1] https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit

https://github.com/Cryptogenic/PS5-4.03-Kernel-Exploit Fine documentation of the process and the (limitations of the) exploit.