Critical Use-After-Free Vulnerability in Lua 5.3 and 5.4 Packages
Summary
ALPINE-CVE-2019-6706: Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. Affects lua5.3 versions < 5.3.5-r2. Fixed in 5.3.5-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lua is a powerful, efficient, lightweight, embeddable scripting language. It is widely used in game development, web applications, and other software projects due to its flexibility and ease of integration. The Lua 5.3 and 5.4 packages are versions of this language that provide various features and improvements over previous iterations. However, these versions are susceptible to a critical vulnerability that can lead to severe consequences if exploited.
Vulnerability Detail
The vulnerability identified as CVE-2019-6706 is a use-after-free issue found in the lua_upvaluejoin function within the lapi.c file of Lua 5.3.5. This flaw allows an attacker to manipulate the arguments of a debug.upvaluejoin call, potentially leading to a crash or arbitrary code execution. The vulnerability arises from improper memory management, where the program continues to access freed memory, which can be exploited to cause instability or execute malicious code.
How To Fix
Minimum fixed version
5.3.5-r2
This is the first release that contains the fix.
sudo apk add --upgrade lua5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the debug.upvaluejoin function until the package is updated. This may help mitigate the risk of exploitation until a proper fix is applied.
Conclusion
The CVE-2019-6706 vulnerability poses a significant risk to applications using Lua 5.3.5 and 5.4. It is crucial to update to the patched versions to mitigate potential exploitation. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert, which can alert in real-time for open-source vulnerabilities.
See every vulnerability recorded for lua5.3 →
FAQ
CVE-2019-6706 is a critical use-after-free vulnerability in Lua 5.3.5 that can lead to crashes or arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If an immediate update is not possible, avoid using the debug.upvaluejoin function as a temporary workaround.
More information about Lua can be found on its official website at https://www.lua.org.
References
Related vulnerabilities
Recent vulnerabilities recorded for lua5.3.
