# Privilege Escalation vulnerability in steam's Remote Play feature leads to arbitrary kernel-mode driver installation

Steam installs Remote Play kernel drivers from a user-writable folder after startup integrity check, letting a local attacker swap in an arbitrary driver for kernel-mode code execution.

- Payout: hidden
- Severity: medium
- Program: Valve
- Found by: hydraskyteam
- Disclosed: 2021-09-21
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/852091
- Library page: https://bugbountylibrary.com/r/h1%3A852091
- Tags: area:os domain:desktop impact:privesc impact:rce kind:bounty platform:hackerone sev:medium tech:windows technique:race-window vuln:privilege-escalation vuln:race-condition

**Target:** steam.exe / SteamServices driver installation on Windows
**Root cause:** Steam verifies file integrity only at startup, then later installs SteamStreamingMicrophone/Speakers drivers from a user-writable path without re-checking integrity, so a file swapped in the window between startup and first Remote Play stream is installed as-is.
**Steps:**
1. Start Steam; it verifies and restores all files in the install folder.
2. Before first Remote Play stream, replace `C:\Program Files (x86)\Steam\drivers\Windows10\x64\SteamStreamingMicrophone.sys` (or `SteamStreamingSpeakers.sys`) with a malicious driver.
3. Trigger first Remote Play stream to SteamLink so SteamServices installs the drivers.
4. Modified driver is installed instead of the original, yielding kernel-mode code execution.
**How found:** Observed that Steam only checks file integrity at startup, and that Remote Play drivers are installed later from a user-writable directory on first stream; hypothesized a TOCTOU window between check and install.
**Exploitation:** Local attacker with write access to the Steam install directory swaps the streaming driver binary after startup integrity check but before the first Remote Play session; SteamServices then installs the attacker's driver, executing code in kernel mode.
**Insight:** Look for TOCTOU gaps where an integrity check at startup is separated in time from a privileged install/load of files in a user-writable path; trigger the deferred install (here, first Remote Play stream) after swapping the binary.