Obsidian Temporarily Removes Games From Sale Due to Unity Exploit

Comments

• Quetzalcutlass@lemmy.world ⁨16⁩ ⁨hours⁩ ago

  This feels unnecessary. From what I’ve heard, the exploit in question requires a local file and only operates at the privilege level of the game itself, so you’re unlikely to encounter it unless you’re adding files to your game install.

  So you’re vulnerable if you install malicious mods, in other words. Which, consisting Unity mods are done via DLL injection, is already the case even without this exploit.

  source

  • DScratch@sh.itjust.works ⁨15⁩ ⁨hours⁩ ago

    Yeah, but if they didn’t do anything then they’d get roasted and maybe sued for negligence.

    source

    • sp3ctr4l@lemmy.dbzer0.com ⁨14⁩ ⁨hours⁩ ago

      Exactly.

      Unity literally issued a statement that every game that is affected by this should be patched with the fix ASAP… and this is people doing that.

      Not like anyone ever runs a game with admin priveleges or anything, right?

      Not like malware from some other source often exploits weird little shit like this that just nobody ever noticed before and thats why that malware stays hidden, right?

      unity.com/security/sept-2025-01

      “No evidence of exploitation” is not the same thing as “we are 100% sure no one has ever been harmed by/via this”.

      cwe.mitre.org/data/definitions/426.html

      Description The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product’s direct control.

      Extended Description

      This might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the product uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted product would then execute. The problem extends to any type of critical resource that the product trusts.

      Some of the most common variants of untrusted search path are:

      In various UNIX and Linux-based systems, the PATH environment variable may be consulted to locate executable programs, and LD_PRELOAD may be used to locate a separate library.
      In various Microsoft-based systems, the PATH environment variable is consulted to locate a DLL, if the DLL is not found in other paths that appear earlier in the search order.
      

      Yeah sounds fairly serious to me, its an 8.4 out of 10 on the severity scale for a reason.

      source

      • -> View More Comments
  • krooklochurm@lemmy.ca ⁨12⁩ ⁨hours⁩ ago

    How many unity games have kernel level anti cheat as a requirement and can this exploit leverage that?

    source

    • sp3ctr4l@lemmy.dbzer0.com ⁨9⁩ ⁨hours⁩ ago

      Oh probably at least some of them, though shouldn’t be a problem, after all, the rootkit kernel level anti cheat is within the game directory and its standard privelege/permission model, and is only there for your safety.

      =D =D =D

      source
• RightHandOfIkaros@lemmy.world ⁨12⁩ ⁨hours⁩ ago

  I dont expect this to last very long, condiering how easy and fast it is to apply the patch. Completely delisting the games feels a little bit excessive.

  source

  • ElectroLisa@lemmy.blahaj.zone ⁨8⁩ ⁨hours⁩ ago

    Grounded 2 uses Unity for their artwork browser and soundtrack player, despite the game being on Unreal

    source
• Darkcoffee@sh.itjust.works ⁨14⁩ ⁨hours⁩ ago

  Grounded is on unreal, not unity, no? Wtf

  source

  • ampersandrew@lemmy.world ⁨13⁩ ⁨hours⁩ ago

    While some of the titles, like Avowed, use Unreal Engine, the artbook is in Unity, hence the takedown.

    source

    • Darkcoffee@sh.itjust.works ⁨12⁩ ⁨hours⁩ ago

      Ah. Thanks.

      source
  • RightHandOfIkaros@lemmy.world ⁨12⁩ ⁨hours⁩ ago

    I think the digital artbook is Unity? At least, thats the case for Avowed digital artbook. Which means delisting the whole game is absolutely excessive.

    source