Relapse-Exploit is a public research chain targeting PS5 firmware 7.00–13.60, chaining a WebKit JSC memory corruption bug with an aio_multi_wait kernel use-after-free race to reach kernel read/write.
| Tool | ntfargo/Relapse-Exploit — JavaScript exploit chain for PS5 firmwares 7.00–13.60, MIT-licensed, ~940 stars |
| Category | Console exploit research / kernel privilege escalation chain |
| Primary Use | Educational study of WebKit JSC exploitation and aio_multi_wait UAF racing to achieve kernel read/write on consoles owned by the researcher |
| Safe Use | Strictly for educational and security research on hardware you own or are explicitly authorized to test, per the project's own disclaimer; not for unauthorized access or piracy |
| Telemetry Note | Console-side, the chain leaves browser history entries, potential kernel panics/crash logs, and reboots; from a defensive standpoint the browser-stage primitives are noise-prone and require multiple reloads, making attempts observable on supervised lab hardware |
Relapse-Exploit is one of the more interesting pieces of public console security research to land on GitHub in recent memory, both because of the firmware range it covers — PS5 system software 7.00 through 13.60, a wide window — and because of how cleanly its README documents the two-stage architecture. Written in JavaScript and released under the MIT license with roughly 940 stars, the project is explicitly framed by its authors as educational research for devices the operator owns or is authorized to test. For anyone studying how modern consoles harden their kernel attack surface, this repository is a compact, readable case study in browser-to-kernel exploitation, and this writeup examines it from that documentary angle only.
The chain begins in the console's WebKit browser, and the README is unusually specific about the primitives involved. The browser stage leverages JSC information leaks — the JavaScriptCore engine's internal pointers escaping into attacker-influenceable state — combined with what the author describes as a structured clone object pool mismatch that corrupts a typedarray. That last detail is the technically interesting one: structured cloning is the serialization machinery used when objects are copied across contexts, and a mismatch in how the object pool is managed during that copy can leave a typedarray's backing store pointing somewhere it should not. Corrupting a typedarray is the classic webkit-exploitation move because it converts a memory-safety bug into a stable, arbitrary relative read/write primitive inside the renderer.
From there, the chain pivots to the kernel. The second stage combines an address leak with a use-after-free race in aio_multi_wait — an asynchronous-I/O syscall family — to establish full kernel read/write. The significance here is architectural: aio_multi_wait belongs to the kernel's async I/O layer, a part of the syscall surface that console vendors historically scrutinize less heavily than the mainstream mmap/pipe paths. A UAF race in that code means two concurrent operations disagree about the lifetime of a shared object, and winning the race lets the exploit reclaim the freed allocation with controlled data. The README's own stability notes are honest about this being a race: the kernel stage may hang or panic the console, requiring a reboot between attempts, which tells you the win rate is probabilistic rather than deterministic.
The staging model is worth dwelling on for a moment, because it explains the repository's shape. The browser stage is pure web content — JavaScript delivered over HTTP to the console's built-in browser — which is why the repo is almost entirely .js and why the authors offer both a locally hosted variant via python serve.py and a statically hosted GitHub Pages entry point. The post-exploitation handoff is equally conventional for console work: after a successful run, payload ELF binaries are served from a payloads/ directory, and an ELF loader listens on port 9021. In other words, the exploit's job is to open a small, trusted loading channel; everything after that is userland research tooling, which keeps the exploit itself minimal and auditable.
What the README reveals about reliability is also instructive. The WebKit stage may need several attempts and the browser can stall, requiring a page reload — a familiar failure mode for JSC heap-grooming exploits, where layout of the JS heap at trigger time is never perfectly deterministic. The kernel stage is even flakier, with hangs and panics called out explicitly. For researchers, this is a useful signal: the bugs are real and reachable, but the engineering effort that separates a research proof-of-concept from a stable tool is substantial, and this project is candid about sitting somewhere in the middle of that spectrum.
The firmware range deserves its own analysis. Supporting 7.00 through 13.60 means the underlying WebKit bug and the aio_multi_wait race either persisted across roughly six years of system software, or the chain's component bugs are individually old and only the composition is new. Console security depends heavily on the browser being the one large, network-reachable attack surface, so a primitive that survives multiple firmware generations illustrates the long tail that unpatched engine bugs can have on closed platforms. Sony's patch cadence for the browser engine is not aligned with upstream WebKit releases, which is precisely the gap this kind of research measures.
The credits section reads like a roll call of the console-hacking research community — TheFlow, Sleirsgoevy, Flatz, Sonic_Iso, Jordy, and others — which matters contextually because it signals that Relapse-Exploit is a synthesis of publicly discussed techniques rather than a single novel discovery. The structured clone corruption and aio_multi_wait race have both circulated in research circles, and this project's contribution is packaging them into a working, documented chain for a specific firmware range. For a student of exploitation, that packaging is itself the lesson: chains, not individual bugs, are what turn memory-safety issues into kernel-level capabilities.
From a defensive and vendor perspective, the detection and mitigation story is straightforward to articulate even without operational detail. The browser stage depends on JSC heap behavior that vendor-side fuzzing and upstream WebKit hardening (structureID validation, allocation quarantine, and similar mitigations) directly erode; the kernel stage depends on reference-counting or lifetime bugs in the async I/O layer that static analysis and syscall fuzzing can surface. Consoles additionally mitigate by requiring the browser to run with reduced privileges and by patching firmware aggressively once chains become public — which is exactly why firmware coverage windows like 7.00–13.60 tend to close quickly after publication.
It is worth noting what the repository does not contain, because that shapes the risk assessment. There is no piracy tooling, no homebrew distribution, no bypass of Sony's content protection beyond the kernel read/write primitive itself, and the disclaimer explicitly disclaims endorsement of piracy and unauthorized access. The project also warns of real operational costs: system instability, data loss, and account bans for anyone running it on connected hardware. Those warnings are not boilerplate — console vendors do enforce account-level consequences, which is one more reason the only sane deployment target is offline lab hardware.
For the authorized researcher who wants to study this work, the responsible path is reading the source and, at most, replicating it on an offline console you own, using the local hosting route (python serve.py) rather than any network-facing setup. There is no reason to point the chain at anyone else's device, and every reason to treat it as a specimen: a well-documented, community-synthesized example of how a renderer memory-safety bug plus a kernel lifetime bug compose into full kernel read/write on a modern, hardened consumer platform. Relapse-Exploit earns its place in the research canon not by novelty alone but by clarity — and clarity like this is what ultimately helps vendors close the underlying bug classes.
ntfargo/Relapse-Exploit.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.