TURNING THE VALVE - EXPLOITING RCE AND LPE IN THE STEAM PLATFORM

Summary from the TLDR InfoSec newsletter

Atredis researchers found four local privilege escalation flaws and two remote code execution bugs in Steam for Windows. The LPE paths abused Steam's SYSTEM service through install-script allowlists, module loading, secure-desktop input forwarding, and driver installation. The remote bugs affected Steam-to-Steam synchronization messages: stack overflows in download-schedule and app-status handlers, plus an uninitialized-memory leak of steamclient64 pointers. The researchers combined the leak with an overflow to build a zero-click RCE using a ROP chain. They reported the issues to Valve through HackerOne. The bugs are patched or past the disclosure timeline, and proof-of-concept code is public.