Critical Stack Buffer Overflow in LuaJIT Package
Summary
ALPINE-CVE-2024-25176: LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240626 have a stack-buffer-overflow in lj_strfmt_wfnum in lj_strfmt_num.c. Affects luajit versions < 2.1_p20240815-r1. Fixed in 2.1_p20240815-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LuaJIT is a Just-In-Time Compiler for the Lua programming language, designed to enhance performance by compiling Lua code into machine code. It is widely used for applications requiring high-speed execution of Lua scripts. However, vulnerabilities in LuaJIT can lead to severe security risks, including arbitrary code execution and system crashes.
Vulnerability Detail
The vulnerability identified as ALPINE-CVE-2024-25176 affects LuaJIT versions through 2.1 and OpenRusty luajit2 before v2.1-20240626. It is characterized by a stack-buffer overflow in the function lj_strfmt_wfnum located in lj_strfmt_num.c. This flaw can be exploited by an attacker to execute arbitrary code, potentially compromising the integrity and confidentiality of the system running the affected software.
How To Fix
Minimum fixed version
2.1_p20240815-r1
This is the first release that contains the fix.
sudo apk add --upgrade luajitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if upgrading is not immediately feasible, consider restricting access to the application using LuaJIT or implementing additional security layers to mitigate potential exploitation of this vulnerability.
Conclusion
The vulnerability ALPINE-CVE-2024-25176 poses a significant risk to systems using affected versions of LuaJIT. It is crucial to update to the patched version to mitigate potential exploitation. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for luajit →
FAQ
A stack buffer overflow occurs when data exceeds the allocated buffer space on the stack, potentially overwriting adjacent memory and leading to unpredictable behavior or security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply providing a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Exploiting this vulnerability can allow attackers to execute arbitrary code, which may lead to data breaches, system crashes, or unauthorized access to sensitive information.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, consider implementing security measures such as restricting access to the application or using alternative libraries until the upgrade can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for luajit.
