PlayStation 5 hacked: Relapse exploit finally cracks the kernel

The Relapse exploit chain relies on a browser-based entry point to compromise the PlayStation 5 kernel. By exploiting vulnerabilities in JavaScriptCore and object copying mechanisms, the chain gains initial foothold within the browser process memory space.

The process moves to the kernel by leveraging a use-after-free vulnerability in the aio_multi_wait function. By tricking the system into referencing memory that has already been cleared, the exploit swaps the content and circumvents memory randomization to grant read and write access to the kernel itself.

Once the door is kicked open, an ELF-loader appears on network port 9021. This allows for the sideloading of homebrew applications, debugging tools, and custom modules directly onto the console hardware. Because this is not a permanent firmware modification, the entire dance must be repeated after every reboot, which is a lovely chore for those who enjoy manual labor.

The irony of a high-tech console acting like a leaky sieve is quite poetic. While Sony plays a constant game of cat and mouse with firmware updates, the community treats these security patches as a mere checklist for the next round of creative code injection.

Source: GitHub