Description

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets into any established session by forging the two-byte connection identifier, enabling session termination via TerminateConnectionPacket, arbitrary channel message forgery, and forged request responses without requiring IP address spoofing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-06T13:18:21.773Z",
  "pubdate": "2026-08-06T13:18:21.773Z",
  "executiveSummary": "Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability within the ConnectionManager component. This security flaw arises because established network connections are resolved exclusively by a two-byte local connection handle without validating that the incoming datagram source address corresponds to the registered remote address associated with that specific connection. An on-path adversary capable of observing cleartext UDP traffic can successfully inject arbitrary packets into any active session by simply forging the two-byte connection identifier. This capability entirely bypasses the need for IP address spoofing. The resulting business impact includes unauthorized session termination through the injection of the TerminateConnectionPacket, the capability to forge arbitrary channel messages, and the ability to inject forged request responses. The affected system involves UDP-based multiplayer or networking sessions managed by the Sonic 3 A.I.R. application, exposing users to active session hijacking and data manipulation if they operate across untrusted network environments.",
  "technicalDetails": "The vulnerability resides in the ConnectionManager component of Sonic 3 A.I.R. prior to commit 2492d18. The root cause of the flaw is inadequate input validation and session state verification during the processing of incoming UDP datagrams. Specifically, when the application receives network packets for established connections, it resolves the target session using only a two-byte local connection handle. The receiving logic fails to perform a secondary validation check to verify whether the source IP address and port of the incoming UDP datagram match the registered remote address bound to the established connection. Because the underlying transport protocol utilizes cleartext UDP, an on-path attacker can passively monitor network traffic to extract the two-byte connection identifiers in real-time. Once the attacker observes a valid connection identifier, they can construct and transmit arbitrary malicious packets containing the forged two-byte identifier directly to the endpoint. Because the application accepts packets solely based on this short identifier, the forged datagrams are processed as legitimate session traffic. The attack flow proceeds as follows: first, the attacker intercepts cleartext UDP traffic to discover an active two-byte connection handle; second, the attacker crafts a malicious packet containing the target handle; third, the attacker transmits the packet to the vulnerable endpoint without needing to spoof their source IP address. This enables several post-exploitation impacts, including the injection of a TerminateConnectionPacket to forcibly tear down active sessions, the forgery of arbitrary channel messages within the application context, and the generation of malicious request responses. No authentication or elevated privileges are required by the attacker, and the vulnerability is exploitable remotely over any network interface exposed to cleartext UDP traffic where session establishment occurs."
}