PT-2020-18892 · Valve · Game Networking Sockets

Eyal Itkin · Published 2020-12-03 · Updated 2022-04-12 · CVE-2020-6017

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Valve's Game Networking Sockets versions prior to v1.2.0

Description The issue arises from the improper handling of long unreliable segments in the function SNP ReceiveUnreliableSegment() when configured to support plain-text messages. This leads to a Heap-Based Buffer Overflow, resulting in memory corruption and possibly even remote code execution.

Recommendations For versions prior to v1.2.0, update to version v1.2.0 or later to resolve the issue. As a temporary workaround, consider disabling the support for plain-text messages or restricting the use of the SNP ReceiveUnreliableSegment() function until a patch is available.

Exploit

Fix

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-120

CWE-787

Related Identifiers

CVE-2020-6017

Affected Products

Game Networking Sockets

References · 7

• 🔥 https://research.checkpoint.com/2020/game-on-finding-vulnerabilities-in-valves-steam-sockets · Exploit
• https://github.com/ValveSoftware/GameNetworkingSockets/commit/e0c86dcb9139771db3db0cfdb1fb8bef0af19c43 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-6017 · Security Note
• https://osv.dev/vulnerability/CVE-2020-6017 · Vendor Advisory
• https://t.me/cibsecurity/17083 · Telegram Post
• https://t.me/cvenotify/6684 · Telegram Post
• https://t.me/cybersecuritytechnologies/2270 · Telegram Post