CVE-2021-48007: PocketMine-MP before 3.18.1 Denial of Service via MovePlayerPacket
PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PocketMine-MPto a version that resolves this vulnerability.Fixed in 3.18.1
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
An attacker needs to connect as a client and send crafted MovePlayerPacket messages. The vector is network-accessible, but the attacker must have low-level privileges, consistent with the PR:L metric.
Are standard movement packets sufficient to cause the problem?
No. Exploitation requires movement position or rotation fields containing invalid floating-point values such as NaN or INF.
What can happen if a vulnerable server receives a crafted packet?
The server can crash due to unhandled mathematical operations. Crafted values can also prevent clients from rendering other players.
Which versions require remediation?
PocketMine-MP versions before 3.18.1 are affected. Upgrade to 3.18.1 or a later version.