moonlight-stream moonlight-common-c GameStream Client buffer overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in moonlight-stream moonlight-common-c. Affected by this issue is some unknown functionality of the component GameStream Client. This manipulation causes buffer overflow. This vulnerability is registered as CVE-2023-42800. Remote exploitation of the attack is possible. No exploit is available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability classified as critical was found in moonlight-stream moonlight-common-c (affected version unknown). Affected by this vulnerability is an unknown functionality of the component GameStream Client. The manipulation with an unknown input leads to a buffer overflow vulnerability. The CWE definition for the vulnerability is CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Moonlight-common-c contains the core GameStream client code shared between Moonlight clients. Moonlight-common-c is vulnerable to buffer overflow starting in commit 50c0a51b10ecc5b3415ea78c21d96d679e2288f9 due to unmitigated usage of unsafe C functions and improper bounds checking. A malicious game streaming server could exploit a buffer overflow vulnerability to crash a moonlight client, or achieve remote code execution (RCE) on the client (with insufficient exploit mitigations or if mitigations can be bypassed). The bug was addressed in commit 24750d4b748fefa03d09fcfd6d45056faca354e0.

The weakness was published 12/14/2023 as GHSA-4927-23jw-rq62. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2023-42800 since 09/14/2023. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

Applying the patch 24750d4b748fefa03d09fcfd6d45056faca354e0 is able to eliminate this problem. The bugfix is ready for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• moonlight-stream

Name

• moonlight-common-c

License

• open-source

Website

• Product: https://github.com/moonlight-stream/moonlight-common-c/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion