Minecraft vulnerability leaves servers exposed to forced crashes

Developer Ammar Askar has revealed a serious vulnerability in Minecraft that will allow just about anyone to crash a hosting server. The security flaw results from the ability of the client to send information to the server about inventory slots; when used in conjunction with the NBT metadata storage format, users can send packets that are "incredibly complex for the server to deserialize but trivial for us to generate."

"The root of the object, rekt, contains 300 lists. Each list has a list with 10 sublists, and each of those sublists has 10 of their own, up until 5 levels of recursion. That’s a total of 10^5 * 300 = 30,000,000 lists," he explained. "And this isn’t even the theoretical maximum for this attack. Just the NBT data for this payload is 26.6 megabytes. But luckily Minecraft implements a way to compress large packets, lucky us! zlib shrinks down our evil data to a mere 39 kilobytes."

The killing stroke comes when the server decompresses that data and then tries to digest it. "When it attempts to parse it into NBT, it’ll create java representations of the objects meaning suddenly, the server is having to create several million java objects including ArrayLists," Askar wrote. "This runs the server out of memory and causes tremendous cpu load."

Askar said he was hesitant to reveal the flaw, but decided to go ahead because Mojang hasn't done anything to fix it despite being warned about it almost two full years ago. "Mojang is no longer a small indie company making a little indie game, their software is used by thousands of servers, hundreds of thousands [of] people play on servers running their software at any given time. They have a responsibility to fix and properly work out problems like this," he wrote. "In addition, it should be noted that giving condescending responses to white hats who are responsibly disclosing vulnerabilities and trying to improve a product they enjoy is a sure fire way to get developers dis-interested the next time they come across a bug like this."

In an update to his post, he noted that in the wake of his revelation, Mojang has identified the problem and attempted to fix it, but has thus far been unable to do so.

Update: Mojang has released a security update that takes Minecraft to version 1.8.4, which fixes the security vulnerability "in addition to some other minor bug fixes & performance tweaks." The update is fully compatible with all previous 1.8 releases, and Mojang strongly recommends that all players upgrade to the new version as soon as possible.

Andy has been gaming on PCs from the very beginning, starting as a youngster with text adventures and primitive action games on a cassette-based TRS80. From there he graduated to the glory days of Sierra Online adventures and Microprose sims, ran a local BBS, learned how to build PCs, and developed a longstanding love of RPGs, immersive sims, and shooters. He began writing videogame news in 2007 for The Escapist and somehow managed to avoid getting fired until 2014, when he joined the storied ranks of PC Gamer. He covers all aspects of the industry, from new game announcements and patch notes to legal disputes, Twitch beefs, esports, and Henry Cavill. Lots of Henry Cavill.