CVE-2018-1000224 Integer overflow in n/a
A remote attacker can cause denial of service and leak uninitialized memory in Godot Engine applications by sending malformed network packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1000224?
CVE-2018-1000224 is a high-severity vulnerability in n/a, published on 20 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Godot Engine version All versions prior to 2.1.5, all 3.0 versions prior to 3.0.6. contains a Signed/unsigned comparison, wrong buffer size chackes, integer overflow, missing padding initialization vulnerability in (De)Serialization functions (core/io/marshalls.cpp) that can result in DoS (packet of death), possible leak of uninitialized memory. This attack appear to be exploitable via A malformed packet is received over the network by a Godot application that uses built-in serialization (e.g. game server, or game client). Could be triggered by multiplayer opponent. This vulnerability appears to have been fixed in 2.1.5, 3.0.6, master branch after commit feaf03421dda0213382b51aff07bd5a96b29487b.
Which versions are affected by CVE-2018-1000224?
It affects 1 product.
Products include Godotengine Godot.
How do I fix CVE-2018-1000224?
No fix has been published for CVE-2018-1000224 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-1000224 being exploited?
There is no known exploitation of CVE-2018-1000224 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rc36-5vc3-6jxx.