CVE-2020-15530: Race Condition

Published Jul 5, 2020

Updated

An issue was discovered in Valve Steam Client 2.10.91.91. The installer allows local users to gain NT AUTHORITY\SYSTEM privileges because some parts of %PROGRAMFILES(X86)%\Steam and/or %COMMONPROGRAMFILES(X86)%\Steam have weak permissions during a critical time window. An attacker can make this time window arbitrarily long by using opportunistic locks.

Affected Software

1 affected component

Valvesoftware Steam Client=2.10.91.91

Event History

Jul 5, 2020

CVE Published

via MITRE·12:31 AM

Data Sourced

via MITRE·12:31 AM

Description

Frequently Asked Questions

What is CVE-2020-15530?

CVE-2020-15530 is a vulnerability in Valve Steam Client 2.10.91.91 that allows local users to gain NT AUTHORITY\SYSTEM privileges due to weak permissions during a critical time window.

What is the severity of CVE-2020-15530?

CVE-2020-15530 has a severity rating of 7.8 (High).

How does CVE-2020-15530 affect Valve Steam Client?

CVE-2020-15530 affects Valve Steam Client version 2.10.91.91.

How can an attacker exploit CVE-2020-15530?

An attacker can exploit CVE-2020-15530 by taking advantage of weak permissions in certain directories during a critical time window to gain NT AUTHORITY\SYSTEM privileges.

Is there a fix available for CVE-2020-15530?

At the time of writing, there is no known fix or patch available for CVE-2020-15530. It is recommended to follow the vendor's security advisory for updates.