Buffer Overflow Vulnerability in Valve's Source SDK Affects Game Security

CVE-2017-20205

What is CVE-2017-20205?

Valve's Source SDK (source-sdk-2013) is susceptible to a stack-based buffer overflow due to insufficient bounds checking in the tokenizer function nexttoken. When the ParseKeyValue function processes a collisionpair rule that exceeds the fixed-size buffer limit of 256 bytes, it can lead to stack memory corruption. An attacker can exploit this vulnerability by supplying maliciously crafted ragdoll models, enabling potential remote code execution on both client and server environments. Although Valve has issued fixes for many of their games, developers of independently created games are required to implement patches manually to mitigate this vulnerability.

References