TLDR Tech / InfoSec
Pwning Call of Duty 1: a 20-year-old RCE, Found in an Evening with AI
Researchers tested Call of Duty 1's Linux dedicated server in Docker, where they found a stack overflow in the rcon map command. A 72-byte buffer accepted an unchecked map name. Sending 76 bytes overwrote the saved return address, and input filtering blocked high-byte addresses and int 0x80. The exploit used a low-memory jmp esp gadget and alphanumeric-safe shellcode with sysentera and it achieved a shell in the game-server process. The flaw requires the rcon password, making it post-authentication RCE.
Read the full story