GHSA-5jfw-35xp-5m42 Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown
A malicious client can crash the PocketMine-MP server by sending a crafted login packet with a negative buffer length, causing an unhandled exception.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-5jfw-35xp-5m42?
GHSA-5jfw-35xp-5m42 is a vulnerability in pocketmine/bedrock-protocol, published on 5 Apr 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
LoginPacket uses BinaryStream->getLInt() to read the lengths of JSON payloads it wants to decode. Unfortunately, BinaryStream->getLInt() returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing BinaryStream->get() to throw an exception.
In the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited.
Patches
e3fce7632b94e83fd6a518a87dcaf6a11681c4ac
Workarounds
This can be worked around by registering a custom LoginPacket implementation into PacketPool which overrides this code to patch it.
For more information
- Email us at [email protected]
Which versions are affected by GHSA-5jfw-35xp-5m42?
2 open source packages ship an affected version, including pocketmine/bedrock-protocol.
| Package | Affected | Fixed in |
|---|---|---|
pocketmine/bedrock-protocol Packagist | All versions | 8.0.2 |
pocketmine/bedrock-protocol Packagist | All versions | 8.0.2 |
How do I fix GHSA-5jfw-35xp-5m42?
Upgrade pocketmine/bedrock-protocol to 8.0.2 or later.
Is GHSA-5jfw-35xp-5m42 being exploited?
There is no known exploitation of GHSA-5jfw-35xp-5m42 in the wild and no public exploit code.