Buffer Overflow and Serialization Vulnerability in Godot Engine
CVE-2018-1000224
Key Information:
- Vendor
Godotengine
- Status
- Vendor
- CVE Published:
- 20 August 2018
Badges
What is CVE-2018-1000224?
A vulnerability exists in the Godot Engine that affects versions prior to 2.1.5 and all 3.0 versions prior to 3.0.6. This vulnerability arises from improper handling of signed/unsigned comparisons, inadequate buffer size checks, and potential integer overflows within the (de)serialization functions located in core/io/marshalls.cpp. An attacker can exploit this vulnerability by sending a malformed packet to a Godot application that relies on built-in serialization, such as in a game server or client scenario. This could lead to a denial-of-service (DoS) condition or leaks of uninitialized memory, particularly in multiplayer environments. The issue has been addressed in subsequent releases.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.