MightyPirates OpenComputers up to 1.8.3 allocation of resources

Summaryinfo

A vulnerability was found in MightyPirates OpenComputers up to 1.8.3. It has been declared as critical. Impacted is an unknown function. Executing a manipulation can lead to allocation of resources. This vulnerability is registered as CVE-2024-31446. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in MightyPirates OpenComputers up to 1.8.3. It has been declared as critical. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a allocation of resources vulnerability. The CWE definition for the vulnerability is CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. As an impact it is known to affect availability. CVE summarizes:

OpenComputers is a Minecraft mod that adds programmable computers and robots to the game. A user can use OpenComputers to get a Computer thread stuck in the Lua VM, which eventually blocks the Server thread, requiring the server to be forcibly shut down. This can be accomplished using any device in the mod and can be performed by anyone who can execute Lua code on them. This occurs while using the native Lua library. LuaJ appears to not have this issue. This vulnerability is fixed in 1.8.4. The GregTech: New Horizons modpack uses its own modified version of OpenComputers. They have applied the relevant patch in version 1.10.10-GTNH.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-31446 since 04/03/2024. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 1.8.4 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• MightyPirates

Name

• OpenComputers

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3

License

• open-source

Website

• Product: https://github.com/MightyPirates/OpenComputers/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion