Stack-based buffer overflow in Game Networking Sockets - CVE-2020-6018
Published: November 18, 2020 / Updated: December 11, 2020
Vulnerability identifier: #VU48928
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-6018
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing long encrypted messages within the AES_GCM_DecryptContext::Decrypt() function. A remote unauthenticated attacker can send specially crafted messages to the application, trigger a stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
Game Networking Sockets
How to mitigate CVE-2020-6018
Install updates from vendor's website.
Game Networking Sockets - update to 1.2.0