CVE-2021-32238
📋 TL;DR
A stack-based buffer overflow vulnerability in Rocket League allows attackers to execute arbitrary code or cause denial of service by crafting malicious UPK object files. This affects Rocket League players running version 1.95 or earlier. Successful exploitation could lead to complete system compromise.
💻 Affected Systems
- Epic Games / Psyonix Rocket League
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, and installation of persistent malware.
Likely Case
Game crashes causing denial of service, potentially with limited code execution in game context.
If Mitigated
Game crashes without code execution if exploit fails or protections are in place.
🎯 Exploit Status
Exploitation requires crafting malicious UPK files that get loaded by the game. Public proof-of-concept exists in vulnerability databases.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: >1.95
Vendor Advisory: https://www.epicgames.com/rocketleague/en/news
Restart Required: Yes
Instructions:
1. Launch Rocket League through Epic Games Launcher. 2. Allow automatic updates to complete. 3. Verify game version is >1.95. 4. Restart the game if prompted.
🔧 Temporary Workarounds
Disable custom content loading
allPrevent loading of custom UPK files that could be malicious
Network segmentation
allIsolate gaming systems from critical network segments
🧯 If You Can't Patch
- Disable Rocket League until patched
- Implement application whitelisting to prevent execution of malicious payloads
🔍 How to Verify
Check if Vulnerable:
Check Rocket League version in game settings or Epic Games Launcher. If version is 1.95 or lower, system is vulnerable.Check Version:
In Rocket League: Settings → Gameplay → Version NumberVerify Fix Applied:
Verify game version is >1.95 in game settings or Epic Games Launcher.📡 Detection & Monitoring
Log Indicators:
- Game crash logs with memory access violations
- Unexpected UPK file loading events
- Process creation from Rocket League executable
Network Indicators:
- Downloads of UPK files from untrusted sources
- Network traffic to Rocket League servers with malformed requests
SIEM Query:
Process:Name='RocketLeague.exe' AND (EventID=1000 OR EventID=1001) AND Message CONTAINS 'ACCESS_VIOLATION'🔗 References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/201129
- https://www.zeroscience.mk/en/vulnerabilities/
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5651.php
- https://exchange.xforce.ibmcloud.com/vulnerabilities/201129
- https://www.zeroscience.mk/en/vulnerabilities/
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5651.php
