CVE-2017-20205: Valve Source SDK Stack-Based Buffer Overflow RCE
Valve's Source SDK (source-sdk-2013)'s ragdoll model parsing logic contains a stack-based buffer overflow vulnerability.The tokenizer function nexttoken copies characters from an input string into a fixed-size stack buffer without performing bounds checks. When ParseKeyValue processes a collisionpair rule longer than the destination buffer (256 bytes), an overflow of the stack buffer szToken can occur and overwrite the function return address. A remote attacker can trigger the vulnerable code by supplying a specially crafted ragdoll model which causes the oversized collisionpair rule to be parsed, resulting in remote code execution on affected clients or servers. Valve has addressed this issue in many of their Source games, but independently-developed games must manually apply patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20205?
CVE-2017-20205 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2017-20205?
To fix CVE-2017-20205, update to a patched version of the Valve Source SDK that addresses the buffer overflow vulnerability.
What does CVE-2017-20205 affect?
CVE-2017-20205 affects the Valve Source SDK version source-sdk-2013 due to improper parsing logic in its ragdoll model.
What are the consequences of exploiting CVE-2017-20205?
Exploitation of CVE-2017-20205 can allow an attacker to execute arbitrary code on the target system, potentially leading to further compromise.
How does CVE-2017-20205 occur?
CVE-2017-20205 occurs when the tokenizer function 'nexttoken' fails to validate bounds while copying input strings into a fixed-size stack buffer.