Data size check in ByteArrayTag, IntArrayTag and LongArrayTag can overflow, allowing DOS
The bug
The data size checks in ByteArrayTag, IntArrayTag and LongArrayTag (Mojang names) can overflow, allowing allocating huge arrays, potentially causing a DOS.
An attacker can exploit this using one of the following packets which deserialize item data:
- ServerboundContainerClickPacket
- ServerboundEditBookPacket
- ServerboundSetCreativeModeSlotPacket
Since this happens before any validation of the packet data occurs there are no requirements except that the player has to have joined the server successfully. An adversary could probably make such a DOS attack more effectively
- by not requesting too large arrays, otherwise the server fails fast with an OutOfMemoryError
- by sending the data for the array elements really slow (but fast enough to not trigger a timeout), otherwise the server fails fast because no / too less array elements are sent (?)
The cause for the overflow it the same for all classes, shown here for LongArrayTag:
LongArrayTag
public LongArrayTag load(DataInput dataInput, int n, NbtAccounter nbtAccounter) throws IOException { nbtAccounter.accountBits(192L); int n2 = dataInput.readInt(); // accountBits accepts a long, however since both 64 and n2 are ints, // the result can overflow first // To fix this, make one of them a long, e.g.: 64L * n2 nbtAccounter.accountBits(64 * n2); long[] arrl = new long[n2]; for (int i = 0; i < n2; ++i) { arrl[i] = dataInput.readLong(); } return new LongArrayTag(arrl); }
2019-11-26, 06:06 PM
2019-12-06, 01:37 PM
2019-12-06, 01:37 PM
1
1