Abstract:
Hacker Jordy used generative AI to discover a vulnerability in the PS5 virtual machine monitor, then submitted a report to Sony through HackerOne and received a $50,000 reward. Since the vulnerability was not originally planned to be made public, this report also caused controversy in the homebrew community.
This vulnerability affects firmware versions 13.60 to 14.00 and can be used to execute kernel code, such as booting Linux on a host that does not originally support related purposes. Google security engineer Andy Nguyen (theflow0) is said to have discovered the same problem and is preparing to postpone the disclosure in order to continue to promote Linux support for PS5 and PS5 Pro.
Jordy said that he initially agreed with theflow0 not to report it, but later another researcher used generative AI to find the same vulnerability. Concerned that the window to collect the bonus might be closed, he eventually reversed his decision. Jordy also said that family pressure and his mother's serious illness were also important backgrounds in his choice to determine the bonus.
Some players originally hoped to keep the vulnerability until "GTA6" is released on November 19, so that they can update to the firmware required by the game, purchase the game normally, and maintain the Linux dual-boot capability. Reporting in advance gives Sony the opportunity to patch vulnerabilities before the game is released. Relevant users may need to choose between retaining Linux functionality offline or upgrading the system.
As generative AI accelerates the rate at which console vulnerabilities are repeatedly discovered by multiple people, it becomes more difficult to sustain the long-term retention of vulnerabilities in the homebrew community. Currently, the vulnerability has been submitted to Sony, and Jordy received a $50,000 vulnerability bounty.
Comments