40 lines
1.8 KiB
Diff
40 lines
1.8 KiB
Diff
# UNDF: UNDF-2026-000001154
|
|
# UNDF: UNDF-2026-XXXXXXXXX
|
|
--- a/rpcs3/Emu/NP/np_structs_extra.cpp
|
|
+++ b/rpcs3/Emu/NP/np_structs_extra.cpp
|
|
@@ -121,8 +121,8 @@ namespace np
|
|
sceNp2.warning("roomPassword: *0x%x", req->roomPassword);
|
|
|
|
- if (req->roomPassword)
|
|
- sceNp2.warning("data: %s", fmt::buf_to_hexstring(req->roomPassword->data, sizeof(req->roomPassword->data)));
|
|
+ if (req->roomPassword)
|
|
+ sceNp2.warning("data: [REDACTED %zu bytes]", sizeof(req->roomPassword->data));
|
|
|
|
sceNp2.warning("groupConfig: *0x%x", req->groupConfig);
|
|
|
|
# Defect: rpcs3-0004
|
|
# MOAD: 0004 (CWE-312 — Cleartext Storage of Sensitive Information)
|
|
# File: rpcs3/Emu/NP/np_structs_extra.cpp
|
|
# Function: print_SceNpMatching2CreateJoinRoomRequest
|
|
# Line: 124
|
|
#
|
|
# Description:
|
|
# When a PS3 game creates or joins a password-protected online room via
|
|
# SceNpMatching2, RPCS3 logs the raw session password bytes verbatim at
|
|
# WARNING severity using buf_to_hexstring. The SceNpMatching2SessionPassword
|
|
# struct holds up to SCE_NP_MATCHING2_SESSION_PASSWORD_SIZE (8) bytes of
|
|
# opaque password material. Any logging framework that persists WARNING-level
|
|
# output — file logs, remote log aggregators, crash-dump collectors — will
|
|
# capture those bytes in cleartext (CWE-312).
|
|
#
|
|
# The JoinRoomRequest path (print_SceNpMatching2JoinRoomRequest) only logs the
|
|
# pointer address, not the data, so that path is not affected.
|
|
#
|
|
# Severity: MEDIUM
|
|
# - Requires WARNING log level to be active (on by default in debug builds)
|
|
# - Password is 8 bytes of opaque PS3 material, used for session access control
|
|
# - If logs are captured by a third-party service the password is exposed
|
|
#
|
|
# Fix:
|
|
# Replace buf_to_hexstring(req->roomPassword->data, ...) with a redacted
|
|
# placeholder that indicates the password is present but does not expose it.
|