Advisoriesby IbisPlayStation Portal (Remote Play): Stack-buffer overflow in HEVC decoder
Summary
The HEVC decoder used in PlayStation Portal's Remote Play does not validate the length of elements copied to an array. This results in an out-of-bounds write on the stack and may lead to RCE. In addition to this buffer overflow, gaps in PlayStation Portal's patching were identified to be vulnerable to CVE-2023-33106
Severity
Moderate - A user who is able to execute this buffer overflow can modify the PlayStation Portal to run arbitrary code. This affects the PlayStation Portal, and all other remote play clients iOS, Android, Windows, and MacOS.
Details
The HEVC decoder used in Remote Play does not check the result of num_long_term_ref_pics_sps, used for an array of lt_ref_pic_poc_lsb_sps and used_by_curr_pic_lt_sps_flag elements:
`
v80 = consume_bits((int)v2, 1);
*(_BYTE *)(this + 224) = v80;
if ( v80 )
{
v81 = -1;
do
++v81;
while ( !consume_bits((int)v2, 1) );
v82 = consume_bits((int)v2, v81);
v128 = 0;
*(_DWORD *)(this + 0xE4) = (1 << v81) + --v82;
if ( (1 << v81) + v82 )
{
v131 = this + 0xE8;
do
{
v83 = -1;
do
++v83;
while ( !consume_bits((int)v2, 1) );
v84 = consume_bits((int)v2, v83);
v85 = v83;
v86 = v131;
*(_DWORD *)v131 = (1 << v85) - 1 + v84; // overflow
v87 = consume_bits((int)v2, 1);
v88 =...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Portal Product | < 2.06 | 2.06 |
Details and references
### Summary The HEVC decoder used in PlayStation Portal's Remote Play does not validate the length of elements copied to an array. This results in an out-of-bounds write on the stack and may lead to RCE. In addition to this buffer overflow, gaps in PlayStation Portal's patching were identified to be vulnerable to CVE-2023-33106 ### Severity Moderate - A user who is able to execute this buffer overflow can modify the PlayStation Portal to run arbitrary code. This affects the PlayStation Portal, and all other remote play clients iOS, Android, Windows, and MacOS. ### Details The HEVC decoder used in Remote Play does not check the result of `num_long_term_ref_pics_sps`, used for an array of `lt_ref_pic_poc_lsb_sps` and `used_by_curr_pic_lt_sps_flag` elements: ``` v80 = consume_bits((int)v2, 1); *(_BYTE *)(this + 224) = v80; if ( v80 ) { v81 = -1; do ++v81; while ( !consume_bits((int)v2, 1) ); v82 = consume_bits((int)v2, v81); v128 = 0; *(_DWORD *)(this + 0xE4) = (1 << v81) + --v82; if ( (1 << v81) + v82 ) { v131 = this + 0xE8; do { v83 = -1; do ++v83; while ( !consume_bits((int)v2, 1) ); v84 = consume_bits((int)v2, v83); v85 = v83; v86 = v131; *(_DWORD *)v131 = (1 << v85) - 1 + v84; // overflow v87 = consume_bits((int)v2, 1); v88 = v128; v131 = v86 + 4; *(_BYTE *)(this + v128 + 0x168) = v87; // overflow v128 = v88 + 1; } while ( (unsigned int)(v88 + 1) < *(_DWORD *)(this + 0xE4) ); } } ``` This results in an out-of-bounds write in the array and may lead to RCE. This affects the PlayStation Portal, and all other remote play clients for iOS, Android, Windows and MacOS. ### Further Analysis #### KGSL vulnerability Additionally, the PlayStation Portal has patch gaps and is vulnerable to [https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-33106.html](https://www.google.com/url?q=https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2023/CVE-2023-33106.html&sa=D&source=buganizer&usg=AOvVaw1tQaWkwSoT73tgZToisy8S) which may allow an attacker to escalate privileges." ### Timeline **Date reported**: 02/21/2024 **Date fixed**: 05/03/2024 **Date disclosed**: 06/14/2024
- Severity from
- GitHub (reviewed advisory)