PT-2022-28200 · Unknown · Pocketmine-Mp

Published 2022-04-05 · Updated 2022-04-05

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PocketMine-MP (affected versions not specified)

Description The issue arises from the LoginPacket using BinaryStream->getLInt() to read JSON payload lengths. Since BinaryStream->getLInt() returns a signed integer, a malicious client can craft a packet with a large uint32 value for the payload buffer size, which is interpreted as a negative signed int32. This causes BinaryStream->get() to throw an exception, leading to a server crash in the context of PocketMine-MP.

Recommendations For PocketMine-MP, consider registering a custom LoginPacket implementation into PacketPool which overrides the vulnerable code to patch it. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-124

Related Identifiers

GHSA-5JFW-35XP-5M42

Affected Products

Pocketmine-Mp

References · 4

• https://osv.dev/vulnerability/GHSA-5jfw-35xp-5m42 · Vendor Advisory
• https://github.com/pmmp/BedrockProtocol/security/advisories/GHSA-5jfw-35xp-5m42 · Note
• https://github.com/pmmp/BedrockProtocol · Note
• https://github.com/pmmp/BedrockProtocol/commit/e3fce7632b94e83fd6a518a87dcaf6a11681c4ac · Note