The Unity team recently revealed a security issue in their game engine, with lots of developers scrambling to update their games. Valve actually already implemented their own fix to help with it in a recent Steam Client update but a fix in games is still the best thing for developers to do.
Some developers temporarily removed their games for sale while they worked to update their games to a newer version of Unity. According to Unity the affect platforms included Android, Linux, Windows and macOS. The Unity team said:
Applications that were built using affected versions of the Unity Editor are susceptible to an unsafe file loading and local file inclusion attack depending on the operating system, which could enable local code execution or information disclosure at the privilege level of the vulnerable application. There is no evidence of any exploitation of the vulnerability nor has there been any impact on users or customers. Unity has provided fixes that address the vulnerability and they are already available to all developers.
This prompted Valve to even post their own full announcement on it for developers as it's such a major issue.
It affects the Unity game engine going back quite a lot of versions, however Unity are only supporting fixes for Unity 2019.1 or newer.
On Linux, the vulnerable Unity command‑line arguments function similarly to the LD_PRELOAD mechanism. Under the standard Linux security model, these arguments do not cross privilege boundaries and therefore do not introduce additional risk relative to what is possible with LD_PRELOAD.
In environments such as AppArmor, bubblewrap, Firejail, or SELinux, if a restricted process can launch a Unity application outside its confinement, arbitrary code execution is already possible and this vulnerability does not add further risk. In certain SELinux or AppArmor configurations, common injection methods (LD_PRELOAD, ptrace) may be blocked while still allowing Unity to be launched with arbitrary arguments. In this case, the vulnerable arguments could bypass policy restrictions and become a viable exploit path.
LINUX WINS!
FLAWLESS VICTORY!
Last edited by tfk on 6 Oct 2025 at 11:27 am UTC