New PS5 Relapse Exploit Unlocks Kernel Access Across Firmware Versions

Overview

A significant security vulnerability affecting the Sony PlayStation 5 console has been made publicly available, granting researchers and homebrew developers kernel-level access across a wide range of system firmware. The exploit, codenamed Relapse, is now live on the public repository of security researcher ntfargo and supports any PS5 running firmware versions from 7.00 up to the most recent 13.60 update.

This development marks a pivotal moment in the longevity of the PS5 hacking scene. For months, the community waited for a reliable path to kernel execution as Sony tightened security measures with each system update. The release of Relapse effectively shatters the current boundary between user-space applications and the core operating system, potentially extending the life of homebrew development and custom firmware projects for the foreseeable future.

The exploit chain operates primarily through the browser, leveraging vulnerabilities in the V8 JavaScript engine, known as Webkit, on the console. By redirecting the system’s DNS settings to a malicious server, users can trigger a series of memory corruption bugs that ultimately lead to arbitrary code execution within the kernel. While the process requires careful execution and some technical know-how, the availability of pre-compiled payloads lowers the barrier to entry for many in the modding community.

Technical Breakdown

The Exploit Chain

The Relapse exploit is a two-stage process that begins in the browser and transitions into the kernel. The initial stage targets the JavaScriptCore (JSC) engine, which powers the web browser on the PlayStation 5. Researchers utilized an info leak to expose internal memory addresses, breaking the isolation that typically prevents web content from accessing sensitive system data.

A critical component of the browser stage is a structured clone object pool mismatch. This vulnerability allows the attacker to corrupt a typed array in memory. By carefully manipulating how objects are copied and stored, the exploit achieves a state of arbitrary read and write capability within the user-space environment. This user-mode foothold is essential for launching the second stage of the attack.

Kernel-Level Access

Once user-space code execution is established, the exploit moves to the kernel phase. This stage combines another address leak with a use-after-free (UAF) race condition targeting a function called aio_multi_wait. This specific kernel object is responsible for handling asynchronous input/output operations, and manipulating its lifecycle allows the exploit to overwrite kernel memory.

The successful race condition grants the attacker read/write access to kernel memory. This is the holy grail of console exploitation, as it bypasses all digital rights management (DRM) signatures and kernel-level checks. With kernel access, researchers can load unsigned code, modify system files, and install custom firmware that is not sanctioned by Sony.

Stability and Implementation

Using the exploit requires users to configure their PS5’s network settings to point to a specific IP address (45.56.67.85) and then access a hosted HTML page via the console’s web browser. Alternatively, users can run a local Python script provided in the repository to serve the exploit payload.

The maintainers have noted that the Webkit stage may require multiple attempts due to the probabilistic nature of the information leaks. If the browser stalls, refreshing the page is the recommended course of action.

The kernel stage is more volatile. Because it relies on a race condition, there is a risk that the exploit may hang or cause the console to panic. If the system becomes unresponsive, a manual reboot is necessary before attempting the exploit again. This instability is common in kernel-level research but underscores the experimental nature of the tool.

Community Impact and Research Context

The release of Relapse is the culmination of collaborative work from a large team of prominent figures in the hardware security research community. Credits are given to researchers including ufm42, Sonic_Iso, Jordy, Dr. Yenyen, TheFlow, and Sleirsgoevy, among others. Many of these individuals have been instrumental in previous exploits for PlayStation and other gaming consoles, making this a significant joint effort.

The popularity of the repository reflects the high demand for this functionality. With over 900 stars and hundreds of forks, the project has drawn attention from both serious security researchers and hobbyist homebrew developers. The MIT license ensures that the code can be used and modified freely, fostering further experimentation and refinement.

Security researchers emphasize that this type of disclosure is vital for understanding the attack surface of modern gaming consoles. By publicly releasing the exploit, the team ensures that Sony and other manufacturers are aware of the vulnerabilities, prompting them to patch future firmware versions. However, it also means that the window for exploiting these specific bugs on unaffected firmware is now closed, pushing the community to seek new vulnerabilities.

Legal and Ethical Considerations

As with most console exploits, the release of Relapse comes with strong disclaimers regarding its intended use. The repository explicitly states that the project is for educational and security research purposes only. It does not endorse piracy, unauthorized access, or the misuse of commercial devices.

Users are advised to comply with all applicable laws and regulations in their jurisdiction. The maintainers assume no liability for any damage, data loss, or account bans that may result from using the software. The PS5’s online services monitor for anomalies, and using a compromised console to connect to the internet carries a risk of being banned by Sony.

The exploit is designed to be used only on devices that the user owns or is authorized to test. This ethical boundary is crucial for maintaining the legitimacy of the security research community. While the tools provided are powerful, their use should remain focused on learning, customization, and preservation rather than copyright infringement.

Looking Ahead

The availability of Relapse changes the landscape for PS5 homebrew. Firmware versions up to 13.60 are now considered "soft-bricked" in terms of security, meaning that users on these versions have a reliable path to kernel execution. This may accelerate the development of user-friendly tools, emulators, and custom themes that rely on low-level system access.

However, the race against Sony’s security team continues. Each new patch reduces the pool of vulnerable firmware versions, and future exploits will likely need to target more complex or obscure vulnerabilities. The community will now likely shift its focus toward developing permanent solutions and exploring hardware-based attacks that cannot be patched through software updates.

For now, the release serves as a testament to the rigorous analysis performed by the security research team. It highlights the inherent complexity of securing a closed ecosystem like the PlayStation 5 and the relentless effort required to maintain such security barriers. As the community adapts to this new reality, the PS5 modding scene is poised for a period of significant innovation and expansion.