CVE-2020-6018
📋 TL;DR
CVE-2020-6018 is a critical stack-based buffer overflow vulnerability in Valve's Game Networking Sockets library when compiled with libsodium. Attackers can send specially crafted long encrypted messages to trigger memory corruption, potentially leading to remote code execution. This affects any application using vulnerable versions of the Game Networking Sockets library.
💻 Affected Systems
- Valve Game Networking Sockets library
- Applications using GameNetworkingSockets (including some Steam components)
📦 What is this software?
Game Networking Sockets by Valvesoftware
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the vulnerable application, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or memory corruption leading to unstable behavior.
If Mitigated
No impact if patched or if proper network segmentation prevents exploitation.
🎯 Exploit Status
Checkpoint Research published detailed analysis and proof-of-concept. The vulnerability requires sending specially crafted network packets to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.2.0 and later
Vendor Advisory: https://github.com/ValveSoftware/GameNetworkingSockets/commit/bea84e2844b647532a9b7fbc3a6a8989d66e49e3
Restart Required: Yes
Instructions:
1. Update GameNetworkingSockets library to version 1.2.0 or later. 2. Recompile any applications using the library. 3. Restart affected services.
🔧 Temporary Workarounds
Disable libsodium compilation
allCompile GameNetworkingSockets without libsodium support to avoid the vulnerable code path.
cmake -DUSE_LIBSODIUM=OFF ..
make clean
make
Network segmentation
allRestrict network access to services using vulnerable GameNetworkingSockets library.
🧯 If You Can't Patch
- Implement strict network firewall rules to limit access to vulnerable services
- Monitor for abnormal network traffic patterns and application crashes
🔍 How to Verify
Check if Vulnerable:
Check if application uses GameNetworkingSockets library version <1.2.0 and was compiled with libsodium support.Check Version:
Check application dependencies or build configuration for GameNetworkingSockets versionVerify Fix Applied:
Verify GameNetworkingSockets library version is 1.2.0 or later and check compilation flags for libsodium.📡 Detection & Monitoring
Log Indicators:
- Application crashes with memory corruption errors
- Abnormal termination of services using GameNetworkingSockets
Network Indicators:
- Unusually large encrypted packets sent to services using GameNetworkingSockets
- Traffic patterns matching known exploit attempts
SIEM Query:
search 'GameNetworkingSockets crash' OR 'buffer overflow' OR 'memory corruption' in application logs🔗 References
- https://github.com/ValveSoftware/GameNetworkingSockets/commit/bea84e2844b647532a9b7fbc3a6a8989d66e49e3
- https://research.checkpoint.com/2020/game-on-finding-vulnerabilities-in-valves-steam-sockets/
- https://github.com/ValveSoftware/GameNetworkingSockets/commit/bea84e2844b647532a9b7fbc3a6a8989d66e49e3
- https://research.checkpoint.com/2020/game-on-finding-vulnerabilities-in-valves-steam-sockets/
