GMS-2022-454: NaN/INF in serverbound movement packets can crash clients and servers

March 18, 2022 (updated March 21, 2022)

A malicious client may send a MovePlayerPacket to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play.

References

github.com/advisories/GHSA-fm35-jgg3-3grx
github.com/pmmp/PocketMine-MP/security/advisories/GHSA-fm35-jgg3-3grx

Code Behaviors & Features

Detect and mitigate GMS-2022-454 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →