Part 3/4:
With this primitive in hand, the attackers can then bypass the Kernel Address Space Layout Randomization (KASLR) by leaking the address of the "PopSoftCList" object, which provides the base address of the kernel image. From there, they construct a series of "ROP gadgets" – pre-existing code snippets within the program – to make the kernel memory globally writable, allowing them to execute their own code.
The exploit's stage one involves cleaning up the corrupted linked list elements, followed by a stage two that binds a TCP server to a specific port, allowing the attackers to inject their payload. The final result is a jailbroken PS4, where the user can now run their own code and applications, effectively taking control of the device.
[...]