THE PATH TO PWNING THE PS VR2 (PART 1) - "RECOVERY MODE"

Summary from the TLDR InfoSec newsletter

A stack overflow vulnerability discovered in Sony's PS VR2 kernel-level USB authentication code allows arbitrary firmware downgrading by exploiting an unchecked `memcpy` in `usb_auth_set_auth1_data` that blindly trusts the USB request buffer length beyond the 64-byte structure size. Repeatedly triggering the overflow on device connection forces the PS VR2 into a hidden recovery mode running initial firmware v01.10, from which any firmware version can be installed despite no eFuse-based downgrade protection being present. The exploit tool "vr2jb" has been publicly released. Researchers recommend downgrading to v06.00 as a stepping stone toward a full jailbreak that could unlock features like eye tracking and haptics on PC.