Abstract:
A cybersecurity researcher nicknamed Jordy recently reported a PS5 vulnerability to Sony and received a $50,000 vulnerability reward from Sony. This vulnerability belongs to the PS5 virtual machine program vulnerability, and the researcher's disclosure of the vulnerability to Sony caused controversy in the jailbreak community, and the developers of the PS5 Linux project also announced that they would stop related work.
Jordy used artificial intelligence to discover vulnerabilities and chose to report the vulnerabilities to Sony to receive rewards. For some users who want to run Linux on PS5, the controversy is mainly about the timing of vulnerability reporting. These users originally hoped to wait until GTA 6 was released before disclosing the vulnerabilities in order to retain the opportunity to use Linux while running the new game.
PS5's hypervisor is responsible for isolating and managing the system's access to the hardware, and security researchers will need to break through relevant restrictions to allow the console to run software other than Sony's system, such as Linux. PS5 Linux project developer and Google security engineer Andy Nguyen has demonstrated running Ubuntu systems and PC games on PS5.
Andy Nguyen has also discovered PS5 security vulnerabilities before, but Andy Nguyen hopes to improve the PS5 Linux project, including PS5 Pro support planned to be completed in 2027. Andy Nguyen has invited other security researchers who have discovered vulnerabilities to wait for GTA 6 to be released before reporting the vulnerabilities to Sony, giving players the opportunity to legally purchase the new game and use Linux at the same time.
However, after the vulnerability was submitted to Sony, Andy Nguyen announced his withdrawal from the PS5 research community and stopped development work on the PS5 Linux project. Jordy said that he initially agreed to postpone the vulnerability report, but other researchers also used AI to discover vulnerabilities. He believed that others might soon submit vulnerabilities and receive bonuses, so Jordy chose to report the vulnerability first.
Sony also operates a bug bounty program that pays bounties to researchers who submit valid security vulnerabilities. Jordy publicly showed off his $50,000 reward on October 14, saying he could at least use the money to buy GTA 6. This behavior has also caused dissatisfaction in the community, which users believe will affect Linux and homebrew development on new firmware.
Sony has fixed the virtual machine vulnerability in the PS5 14.20 system update released on October 21. Existing PS5 Linux projects can still run on the old version of firmware, but the new version of the firmware can no longer be used.
Comments