CVE-2020-15007
📋 TL;DR
This CVE describes a buffer overflow vulnerability in the Doom engine (id Tech 1) that allows arbitrary code execution. Attackers can exploit unsafe fscanf usage in the M_LoadDefaults function to execute malicious code. Anyone using affected Doom engine-based software is potentially vulnerable.
💻 Affected Systems
- Doom engine (id Tech 1)
- Doom
- Doom II
- Heretic
- Hexen
- Strife
- various source ports
📦 What is this software?
Doom Vanille by Doom Vanille Project
Tech 1 by Idsoftware
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, potentially leading to full control of affected systems.
Likely Case
Local privilege escalation or game client compromise when loading malicious configuration files.
If Mitigated
Denial of service or application crash if exploit fails or is blocked.
🎯 Exploit Status
Exploitation requires local access or tricking users into loading malicious configuration files. Public references demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in commit 8a6d9a02fa991a91ff90ccdc73b5ceabaa6cb9ec
Vendor Advisory: https://github.com/AXDOOMER/doom-vanille/commit/8a6d9a02fa991a91ff90ccdc73b5ceabaa6cb9ec
Restart Required: Yes
Instructions:
1. Update to patched version of Doom engine or source port. 2. Apply the fix from the GitHub commit. 3. Recompile if using source code. 4. Restart the application.
🔧 Temporary Workarounds
Restrict configuration file access
linuxPrevent loading of untrusted configuration files by restricting file permissions.
chmod 600 default.cfg
chown root:root default.cfg
Use modern source ports
allSwitch to actively maintained Doom source ports that have addressed this vulnerability.
🧯 If You Can't Patch
- Run Doom engine software with minimal privileges (non-admin/non-root accounts)
- Isolate Doom engine applications in sandboxes or virtual machines
🔍 How to Verify
Check if Vulnerable:
Check if your Doom engine version includes the vulnerable fscanf usage in m_misc.c M_LoadDefaults function.Check Version:
Check source code or consult your Doom engine/source port documentation for version information.Verify Fix Applied:
Verify the patched commit 8a6d9a02fa991a91ff90ccdc73b5ceabaa6cb9ec is applied in your codebase.📡 Detection & Monitoring
Log Indicators:
- Application crashes when loading configuration files
- Unexpected process execution from Doom engine
Network Indicators:
- Unusual network connections from Doom engine processes
SIEM Query:
Process Creation where Parent Process contains 'doom' OR Image contains 'doom' AND Command Line contains unusual arguments