Executive brief
PocketMine-MP is a popular game server software for Minecraft: Pocket Edition. A vulnerability in packet handling allows attackers to remotely crash the server by sending a malformed book-edit packet with an invalid inventory slot value, causing temporary unavailability and potential player session loss.
Technical details
The vulnerability is a denial of service in the BookEditPacket handler within InGamePacketHandler.php. When a client sends a BookEditPacket with an inventorySlot value greater than 35, the server attempts to access an invalid inventory index, triggering an unhandled exception in BaseInventory->getItem() that crashes the server. The attack requires a low-privilege authenticated client connection (player login). The fix, released in version 5.11.2, adds validation to check if the inventory slot exists before attempting to access it, preventing the exception.
Affected products
- PocketMine PocketMine-MP before 5.11.2
Timeline
- 2024-03-05: disclosed
- 2024-03-05: patched: Fixed in version 5.11.2