7 ms·
A Remote Code Execution Vulnerability in the Steam Client
- Something1234 8y agoWhy do people write their own memory allocators and put them in production software for modern desktop applications? It's not like you can eek that much more performance out, and the steam client is already fairly buggy. Switching the views is slow, and doesn't always work.
- tptacek 8y agoThe system allocator is tuned for general purpose workloads. If you know something specific about your workload, like size or frequency or lifetime, you can do better, and sometimes "better" means "by a lot". It's not like a heap overflow wouldn't have been a big deal otherwise, for what it's worth.
- asfasgasg 8y agoDo you really think this is why, though? It's hard to picture Steam the application being performance sensitive.
- pvg 8y agoThere's voice chat, a couple of different streaming doodads, other real-timey social features.
- ManlyBread 8y agoIt used to work really bad on low-end machines.
- newnewpdro 8y agoIt's not like the bug was in their allocator, which sounds like nothing more than a free list of small fixed size objects sliced from larger chunks allocated using the system allocator. That's not a complicated thing, and it can have a significant performance impact.
- jchw 8y agoThe easiest way to explain it is to go backwards and ask if a one-size-fits-all allocator can really be optimal for most of its users. The answer is probably no. At the very least, most software that has a lot of memory churn could benefit from trying to reuse memory before going down to the allocator. When it comes to particular kinds of objects, like strings, it is very clear that you can have enormous performance benefits from relatively small tweaks.
- mastax 8y agoValve is a games company. They probably already had a stable of allocators and were used to that kind of programming. Also the Windows malloc was much slower in 2003 IIRC.
- tejasmanohar 8y agoI'm guessing it's more this. I can't imagine the Steam app demands that high performance.
- kbenson 8y agoWell, since steam is in the background during all the games launched from it, often allows a special video overlay to browse community features while the game is running, supports chat, has an embedded browser, and can be used as an operating system overlay so you don't even have to use the OS for most things (big picture mode, for dedicated use and control with a game controller), I can imagine they probably want to make sure whatever allocator and reclamation scheme they are using has very low and predictable latency. The last thing they want to have to deal with is people reporting how running the game through steam costs a non-negligible amount of performance, or causes weird occasional lags/stalls while playing. In that respect, it's an extremely high performance application, in that it needs to be nigh unnoticeable to the type of people that overclock systems, push their graphics cards to their limits, and play games with FPS counters always showing in the corner. In that respect, it may be a textbook case of an application where you want a very specific memory allocation scheme that falls within very strict performance guidelines.
- baud147258 8y agoIn addition to the community features while the game is running, the Steam client has to support the screenshot and broadcast functionnalities
- Something1234 8y agoIt already has a large number of performance issues. The store is slow to open, and it's slow to switch to my library. Even slower to view my inventory.
- xenadu02 8y agoWhy people compile without stack cookies, ASLR, or any other mitigations is another mystery. Writing your own protocol and/or memory allocator without fuzzing either is also highly dubious.
- nitwit005 8y agoRe-using buffers, and only falling back to normal allocations for large sizes is fairly normal in networking code. You see the same strategy used in code for reading things like HTTP requests, in just about every language. For example, Googling "Jetty buffer reuse" immediately popped up their ByteBufferPool class: https://www.eclipse.org/jetty/javadoc/9.4.8.v20171121/org/eclipse/jetty/io/ByteBufferPool.html https://www.eclipse.org/jetty/javadoc/9.4.8.v20171121/org/ec...
- zawerf 8y agoI just realized I only think about security vulnerabilities for code I deploy, not software I use. So what are some examples of RCE vulnerabilities that were actively exploited in consumer software in the past? Just curious how it would've played out if a blackhat had discovered this instead.
- lytedev 8y agoI think your browser, the various MS office applications, and Acrobat reader are some of the big ones that spring to mind, but there have quite a few!
- deleted 8y ago[deleted]
- overcast 8y agoSorry, just so I'm reading this right, you never think about security issues EXCEPT for stuff you write? Not even OS patches or browsers?!
- acct1771 8y agoWhat makes you think one or more didn't?
- fowl2 8y agoThey also* change the ACLs on their executable directory to world writeable, despite having a system service. I say despite because: a. With a system service you wouldn't need to change the ACLs b. now anyone everyone has a system service, yay! * well, I haven't checked this week
- yread 8y agoSteam Client is so incredibly bloated - I wish they released a Lite version without Steam Link, Achievements, Trading cards/Inventory, Browser, Community, Workshop, Hub, ... It could also update less frequently if it had fewer features and updates would be faster. Just the list of games I have and the DRM required to play them.
- nmbr213 8y ago> Achievements, Trading cards/Inventory, Browser, Community, Workshop Doesn't all of that work through embedded web-browser?
- maze-le 8y agoI think the embedded browser is where the most bloat is located. Although this particular vulnerability is not tied to it.
- baud147258 8y agoIt work through a slow embedded web-browser.
- MarchewaJP 8y agoDisplaying achievements yes, but obtaining them has to interact in some ways with rest of the client. Trading cards and inventory probably too.
- Fnoord 8y agoValve's Steam uses VGUI toolkit (proprietary), and a WebKit-based embedded browser.
- Starz0r 8y agoYou are in luck, Valve has SteamCMD[1] for users just like yourself! It is a command line version of the Steam client and can do most of what you need like downloading, updating, even verifying game integrity from the command line! I only wish it was open source, maybe someone can reverse engineer it? [1] https://developer.valvesoftware.com/wiki/SteamCMD https://developer.valvesoftware.com/wiki/SteamCMD
- pro_zac 8y ago"The video below demonstrates an attacker remotely launching the Windows calculator app on a fully patched version of Windows 10." So devious!
- viraptor 8y agoLaunching the calculator is basically a "hello world" of exploitation. It proves there's an issue in an obvious way and became a bit of a meme in security.
- munin 8y agoI remember reading that Valve is all self-organized and perf/bonuses are based on shipping. In that environment, is there any incentive for an IC to own something like software assurance / quality / fuzzing?