Vulnerability Details
CVE ID: CVE-2020-12630, CVE-2020-12631
Type: Denial of Service
Discovered: 2020/01/31
Discovered By: Jack Baker
Patch Availability: 2020/05/19
Affected Operating System: All supported platforms
Affected Versions: All
Severity: High
Patch Versions:
- [1] 2019.3.14f1
https://unity3d.com/unity/whats-new/2019.3.14 - [2] 2018.4.23f1
https://unity3d.com/unity/whats-new/2018.4.23 - [3] 2017.4.40f1
https://unity3d.com/unity/whats-new/2017.4.40 - [4] 2020.2.0a11
https://unity3d.com/unity/alpha/2020.2.0a11 - [5] 2020.1.0b9
https://unity3d.com/unity/beta/2020.1.0b9
Two out-of-bounds memory issues were identified in the Unity Multiplayer and Networking UNET feature affecting games and applications built with the Unity Editor using UNET. These issues could lead to Denial Of Service (DoS), allowing an attacker to crash the Unity process, and potentially the game or application.
Remediation Steps
Determine the version of your Unity Editor
Open a Unity project.
The Unity version is visible in the main window title.

Install Update
If your version of the Unity Editor is not one of the listed Patch Versions of the Vulnerability Details section above you can continue with the update installation as follows.
To install the update you can use the Unity Editor update checker available in the File menu Help -> Check for Updates.

Additionally, you can download and install the corresponding patch for your version of the Unity Editor. The download links are available in the Patch Versions of the Vulnerability Details section and in the References section.
Build and deploy
Once you have updated the Unity Editor, you can move forward with making a new build of your game or application and deploy the new fixed version.
FAQ
Two out-of-bounds memory issues were identified that could lead to Denial Of Service (DoS), allowing an attacker to crash the Unity process, and potentially the game or application.
Yes. Games and applications built with the Unity Editor using the Unity Multiplayer and Networking UNET feature are affected.
Only Unity UNET is affected by the identified vulnerabilities.
It depends on the specific version of the Unity Editor that you are using. Most customers will be able to update to the patched versions without needing to rebuild their bundles, but some customers may find that asset importers have been updated between the version they are currently using and the patch for that dot-release. For those customers, asset bundle rebuilding may be necessary.
All supported platforms are affected.
All platform versions are affected.
All versions of the Unity Editor are affected.
We have released a patch for all officially supported versions of the Unity Editor up to 2020.2 Alpha. All future versions will contain the update as well.
Unity will be releasing a single patch to each of the most current versions, i.e., last update of the Unity Editor.
Our focus right now is on addressing the identified vulnerabilities in all officially supported versions up to 2020.2 Alpha. We are not planning to release a patch for other versions of Unity.
Our focus right now is on addressing the identified vulnerabilities in all officially supported versions up to 2020.2 Alpha. We are not planning to release a patch for other versions of Unity
You may need to rebuild your bundles if any assets are re-imported when you first open your project in the patched version of the Unity Editor.
References
- [1] 2019.3.14f1
https://unity3d.com/unity/whats-new/2019.3.14 - [2] 2018.4.23f1
https://unity3d.com/unity/whats-new/2018.4.23 - [3] 2017.4.40f1
https://unity3d.com/unity/whats-new/2017.4.40 - [4] 2020.2.0a11
https://unity3d.com/unity/alpha/2020.2.0a11 - [5] 2020.1.0b9
https://unity3d.com/unity/beta/2020.1.0b9