View all newsletters
Receive our newsletter - data, insights and analysis delivered to you

Remote Code Execution Vulnerability in Gaming Platform Steam

A vulnerability that could have resulted in Remote Code Execution in all 15 million active clients…

By Shrina Gohil

A new report reveals a bug had existed in the gaming client, Steam for at least the past ten years and would have resulted in Remote Code Execution in all 15 million active clients if it was not reported by Information Security firm Context.

Context reported the vulnerability to Valve on the February 20, 2018 and it was fixed less than 12 hours later, the Steam Self Updater confirmed this by stating, “Thanks to Tom Court from Context Information Security for reporting this issue”.

Vulnerability details

The vulnerability was a form of corruption inside the Steam client library which could be remotely triggered; furthermore, it was inside an area of coding which dealt with fragmented datagram reassembly from multiple received UDP packets.

The “Steam protocol” is the custom protocol that the Steam client uses for communication. It is delivered on top of UDP and there are two fields in this protocol that contributed to the vulnerability: packet length and total reassembled datagram length.

The vulnerability was caused by the absence of a simple check to ensure that the specified packet length was less than or equal to the total datagram length for the first packet. Despite this being checked for the following packets carrying fragments of the datagram, it may have just been a simple mistake.


Overall, it is clear that this was a very simple bug which was made straightforward to exploit due to a lack of modern security protections.

The vulnerable code was most likely very old and as it was working perfectly fine, the developers did not go near it or update their scripts.

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

With this example, developers must periodically include aging code and build systems in reviews to ensure they adhere to modern security standards even if the functionality of the code has remained unchanged.

As such a simple bug with such serious implications has existed for years in such a popular software platform like Steam, perhaps there are still more bugs to be found in 2018 in other large platforms as well.

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.