Atredis Partners Finds Six Steam Vulnerabilities, Reports All to Valve
Atredis Partners published findings on October 28 from its investigation into Steam's inter-device communication processing. Researchers led by Bryan Alexander reported two remote code execution issues and four local privilege escalation issues, confirmed in a Windows environment with proof-of-concept results.
1 source 15m ago
Reporting from 1 source: Game Spark.
Why it matters
The demonstrated remote code execution needs a client already logged in to the same Steam account, so the immediate third-party attack risk is low, but the report shows Steam's inter-client messaging as an attack surface that researchers can chain into zero-click execution.
Key Facts
- Atredis Partners published its Steam vulnerability findings on October 28.
- Bryan Alexander and colleagues reported two remote code execution issues and four local privilege escalation issues, confirmed in a Windows environment.
- The remote code execution flaws were found in communication processing between Steam clients logged in with the same account.
- The researchers demonstrated zero-click code execution by combining a flaw with a separate information leakage bug.
- Alexander said all issues were reported through Valve's HackerOne program, and published content is fixed or past the disclosure deadline.
Alexander said all were reported through Valve's HackerOne program, and the published material is either already fixed or past its disclosure deadline.
The remote code execution flaws sit in message handling between Steam clients signed in with the same account. Atredis names two cases: messages that notify of download schedule changes and messages that notify of game install or update status. Combining one of those with a separate information leakage bug produced zero-click execution, with no click or file open needed on the target machine.
The four local privilege escalation findings include a path to SYSTEM privileges through the processing of a game installation script. Alexander said the flaws went to Valve through HackerOne, and that what is published is fixed or past the disclosure deadline.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google