CVE-2024-31446: OpenComputers Minecraft Mod DoS Vulnerability

CVE-2024-31446 Overview

CVE-2024-31446 is a denial-of-service vulnerability in OpenComputers, a Minecraft mod that adds programmable computers and robots to the game. Any user able to execute Lua code on an in-game device can trigger a condition where a Computer thread becomes stuck inside the native Lua virtual machine. The stuck Computer thread eventually blocks the Server thread, forcing operators to shut the Minecraft server down manually. The issue affects the native Lua library implementation and does not appear in the LuaJ backend. The vulnerability is categorized as Allocation of Resources Without Limits or Throttling [CWE-770] and is fixed in OpenComputers 1.8.4.

Critical Impact
Any authenticated player able to run Lua on an OpenComputers device can hang the Minecraft server, requiring a forced shutdown.

Affected Products

OpenComputers Minecraft mod versions prior to 1.8.4
GregTech: New Horizons modpack versions prior to 1.10.10-GTNH (uses a modified OpenComputers build)
Deployments using the native Lua library backend (LuaJ backend is not affected)

Discovery Timeline

2024-04-16 - CVE-2024-31446 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-31446

Vulnerability Analysis

OpenComputers exposes a sandboxed Lua runtime that in-game devices execute on dedicated Computer threads. The Minecraft Server thread coordinates state between these Computer threads and the world simulation. When a Computer thread stalls indefinitely inside the native Lua VM, the Server thread waits on the Computer thread and eventually locks up as well.

The vulnerability stems from missing enforcement of the execution deadline inside recursive pcall() and xpcall() invocations. A malicious script can construct an infinite chain of protected calls that never yield control back to the scheduler. Because the deadline check runs only around the outer boundary of a call, nested protected calls keep the VM busy past its intended timeout.

Exploitation requires only the ability to run Lua on an OpenComputers device, which any player interacting with a computer or robot block possesses. No memory corruption or code execution occurs. Impact is limited to availability of the affected Minecraft server.

Root Cause

The root cause is unbounded resource consumption [CWE-770] in the Lua sandbox scheduler. The pcall wrapper in src/main/resources/assets/opencomputers/lua/machine.lua did not validate the Computer thread's execution deadline before dispatching to the underlying pcall. Recursive or looping protected calls therefore evaded the timeout mechanism intended to bound script runtime.

Attack Vector

An attacker with Lua execution access on any OpenComputers device submits a script that repeatedly invokes pcall() or xpcall() in a way that never returns control. The Computer thread remains busy inside the native Lua VM, and the Server thread eventually blocks waiting on Computer thread synchronization. The following patch from the upstream fix illustrates the correction:

lua

   next = next,
   pairs = pairs,
   pcall = function(...)
+    -- prevent infinite pcall() loops by checking deadline before pcall()
+    local status, err = pcall(checkDeadline)
+    if not status then return false, err end
+
     return pcallTimeoutCheck(pcall(...))
   end,
   print = nil, -- in boot/*_base.lua

Source: OpenComputers commit 9d4f7ea

The fix invokes checkDeadline inside its own pcall before delegating to the user-supplied call, ensuring the deadline check cannot be bypassed by nested protected calls.

Detection Methods for CVE-2024-31446

Indicators of Compromise

Minecraft server processes that stop responding to client input while a specific player is running scripts on an OpenComputers device.
Java thread dumps showing a Computer thread stuck in the native Lua VM with the Server thread blocked awaiting synchronization.
Repeated need to SIGKILL or forcibly restart the java process hosting the Minecraft server after Lua execution activity.

Detection Strategies

Monitor OpenComputers debug logs for scripts that exceed configured execution deadlines without terminating.
Correlate server hang events with the last player to execute Lua on an OpenComputers device using audit logs.
Alert on Minecraft server processes whose main tick loop stalls beyond a defined threshold while CPU remains pinned in a JVM worker thread.

Monitoring Recommendations

Ingest Minecraft server logs and JVM metrics into a centralized logging or SIEM platform for hang-pattern analysis.
Track process uptime and unplanned restarts on Minecraft hosts running OpenComputers to identify recurring denial-of-service patterns.
Enable JVM watchdog telemetry so long-running Lua scripts and blocked Server threads generate actionable alerts.

How to Mitigate CVE-2024-31446

Immediate Actions Required

Upgrade OpenComputers to version 1.8.4 or later on all Minecraft servers running the mod.
Upgrade GregTech: New Horizons modpack deployments to version 1.10.10-GTNH or later, which includes the backported patch.
Restrict OpenComputers device placement and Lua execution privileges to trusted players until patches are deployed.

Patch Information

The fix is committed upstream in OpenComputers commit 9d4f7ea and documented in GitHub Security Advisory GHSA-54j4-xpgj-cq4g. The patch adds a checkDeadline call inside the pcall wrapper in machine.lua so recursive protected calls cannot bypass the execution timeout.

Workarounds

Configure OpenComputers to use the LuaJ backend instead of the native Lua library, which is not affected by this issue.
Disable OpenComputers computers and robots on public servers until the upgrade to 1.8.4 is applied.
Limit player permissions so only vetted operators can place or interact with OpenComputers devices in production worlds.

bash

# Example: verify installed OpenComputers version on a Forge server
unzip -p mods/OpenComputers-*.jar META-INF/MANIFEST.MF | grep -i version

# Replace vulnerable jar with the patched release
rm mods/OpenComputers-MC1.12.2-1.8.3+*.jar
cp OpenComputers-MC1.12.2-1.8.4+*.jar mods/