讀書會-CVE-2025-59489.pdf

Transcript

1. CVE-2025-59489 Arbitrary Code Execution in Unity Runtime Presenter: Fox, Date: 10/31
2. Outline • Overview of Vuln. • Explain Unity Runtime • Cause of Vulnerabilities • Vulnerability impact • Conclusion
3. Overview • Affect Platform: Android, Windows, Linux, MacOS • Affect Version: Since 2017.1 to 6000.x • Vulnerability Type: CWE-426: Untrusted Search Path • Allows loading of arbitrary native libraries (ex. .so, .dll) • CVSS Score: 8.4 HIGH • Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4. Common Unity Game • According to “The Big Game Engine Report of 2025”: 51% of released games were made using Unity. • Fall Guys • Pokemon GO • Among US • Monument Valley • Etc.
5. Unity Runtime Binary • Windows: UnityPlayer.dll • Android: libunity.so
6. Unity with cli argument -- Windows • Unity allow using cli execute with argument • -batchmode: headless mode, without window and gui • -logfile: write unity logs to file • -quit: exit immediately after running batch tasks • -xrsdk-pre-init-library: load a custom XR SDK library before Unity’s XR initializes.
7. Argument without validation • The magic argument: “-xrsdk-pre-init-library” • Explain why need this argument • Allowing anyone to specify a library to load • With the application permission • Demo
8. Conclusion • There are no known public attacks exploiting this vulnerability. • After public disclosure, its real-world impact will likely be much lower. • The Steam launcher will automatically filter out malicious parameters.
9. Ref • CVE-2025-59489: Arbitrary Code Execution in Unity Runtime https://flatt.tech/research/posts/arbitrary-code-execution-inunity-runtime/ • Unity Security Update Advisory https://unity.com/security/sept-2025-01