Executive brief
PocketMine-MP is a server software for the Minecraft Pocket Edition multiplayer protocol. A vulnerability in versions before 3.18.1 allows malicious clients to send movement packets containing NaN or INF values, causing servers to crash through unhandled mathematical operations or leaving clients unable to render other players. This can disrupt game server availability and player experience.
Technical details
The vulnerability is an input validation flaw in PocketMine-MP's MovePlayerPacket handler. The server fails to validate position and rotation fields for NaN (Not-a-Number) or INF (Infinity) floating-point values. Malicious clients can send crafted movement packets with these invalid values, triggering unhandled mathematical operations that generate PHP warnings converted to exceptions, crashing the server. Clients also fail to handle these invalid values, preventing proper rendering of players with NaN/INF rotations and potentially crashing the client. No authentication or user interaction is required; the attack is executed via direct network connection. The patch (version 3.18.1) adds explicit validation to reject movement packets containing bogus floating-point values.
Affected products
- PocketMine PocketMine-MP before 3.18.1
Timeline
- 2021-05-19: disclosed: GHSA-fm35-jgg3-3grx published
- 2021-05-19: patched: PocketMine-MP 3.18.1 released with fix