Executive brief
PocketMine-MP is a server software for Minecraft: Pocket Edition. A malicious player can send specially crafted inventory transaction packets that cause the server to freeze due to exponential processing complexity, effectively denying service to legitimate players.
Technical details
The vulnerability exists in the InventoryTransaction component's findResultItem() method, which handles inventory action chaining. When a malicious client sends InventoryTransactionPackets with conflicting slot change actions that have the same origin and target, the method's logic for flattening these chains into a single action exhibits exponential time complexity. No authentication is required; an unauthenticated network client can trigger the freeze. The fix, available in version 3.15.4, detects and rejects ambiguous chains rather than attempting to resolve them, preventing the exponential slowdown.
Affected products
- PocketMine PocketMine-MP before 3.15.4
Timeline
- 2020-11-10: disclosed: GitHub Security Advisory GHSA-8jq6-w5cg-wm45 published
- 2020-11-10: patched: Version 3.15.4 released with fix
- 2020-11-10: exploited: Advisory notes exploit being used in the wild at time of disclosure