Steam, HL2 & TF2 have a security exploit in Ubuntu

steamclosed duplicate

ValveSoftware/steam-for-linux#2073 · opened 2013-03-02 by abc-mikey · updated 2013-03-08 · 3 comments · github

Aabc-mikey 2013-03-02 github

Steam, HL2 & TF2 have a security bug which could be exploited to inject code and execute it. They use writeable and executable heap memory this is a very bad thing, and would be forbidden on Windows under Data Execution Prevention (DEP).

hl_linux makes a call:

sys_mprotect(0x091C1000, 49152 /* 48 kibibyte */, PROT_READ | PROT_WRITE | PROT_EXEC);

This is a bug and should be fixed!

This exploit is currently open on ALL Linux distributions WITHOUT SELinux including Ubuntu.

Report for Half Life 1:

type=SYSCALL msg=audit(1361310021.813:3895): arch=40000003 syscall=125 success=no exit=-13 a0=91c1000 a1=c000 a2=7 a3=ffbd2fcc items=0 ppid=14935 pid=14938 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=5 tty=(none) comm="hl_linux" exe="/home/mikey/.local/share/Steam/SteamApps/common/Half-Life/hl_linux" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

and for Team Fortress 2:

type=SYSCALL msg=audit(1361920952.323:124): arch=40000003 syscall=125 success=no exit=-13 a0=92ca000 a1=c000 a2=7 a3=ffa41d1c items=0 ppid=5217 pid=5222 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=2 tty=(none) comm="hl2_linux" exe=2F686F6D652F6D696B65792F2E6C6F63616C2F73686172652F537465616D2F537465616D417070732F6D6F6E636F6D70746532312F5465616D20466F72747265737320322F686C325F6C696E7578 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key=(null)

MMrSchism 2013-03-04 github

SELinux issues go as far back as bug #43. The first Ubuntu SELinux bug was #88.

Closing as duplicate.

Aabc-mikey 2013-03-04 github

Well I'm sorry to see that Valve are closing bug reports for security exploits on spurious grounds. The bug report was clear that this is an exploit reported by SELinux but the exploit has nothing to do with SELinux and is open on the target platform Ubuntu.

Of the 2 bugs you listed; #43 was closed as a Fedora bug with no further action, and #88 was a separate execheap bug in Webkit that was reported upstream and that they are dealing with.

Since Valve are doing nothing about this I will have to report it to other parties whose security this may affect.

Jjohndrinkwater 2013-03-08 github

Both the issues are in 3rd party toolkits Valve uses, libcef & libmiles, and they have explained in the other bugs why they are used. Please comment further on those other bugs, thank you.

Nothing extracted yet.