Denial of Service Vulnerability in LuaJIT Package
Summary
ALPINE-CVE-2024-25177: LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an unsinking of IR_FSTORE for NULL metatable, which leads to Denial of Service (DoS). Affects luajit versions < 2.1_p20240815-r1. Fixed in 2.1_p20240815-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LuaJIT is a Just-In-Time Compiler for the Lua programming language, designed to improve performance by compiling Lua code into machine code. It is widely used in applications requiring high performance and efficiency. However, certain versions of LuaJIT are susceptible to a vulnerability that can lead to Denial of Service (DoS) attacks, compromising the stability of applications relying on this package.
Vulnerability Detail
The vulnerability identified as CVE-2024-25177 affects LuaJIT versions up to 2.1 and OpenRusty luajit2 before v2.1-20240314. It arises from an unsinking of IR_FSTORE for NULL metatables, which can be exploited to cause a Denial of Service (DoS). This means that an attacker could potentially disrupt the normal functioning of applications using LuaJIT, leading to service outages and degraded performance.
How To Fix
Minimum fixed version
2.1_p20240815-r1
This is the first release that contains the fix.
sudo apk add --upgrade luajitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement checks in your application to avoid using NULL metatables with IR_FSTORE operations. However, the best course of action is to update to the patched version as soon as possible.
Conclusion
The vulnerability CVE-2024-25177 in LuaJIT poses a significant risk of Denial of Service (DoS) attacks. It is crucial for users of affected versions to update to the patched version to maintain application stability and security. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for luajit →
FAQ
CVE-2024-25177 is a vulnerability in LuaJIT that can lead to Denial of Service (DoS) due to an unsinking of IR_FSTORE for NULL metatables.
The affected versions include all LuaJIT versions up to 2.1 and OpenRusty luajit2 before v2.1-20240314.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to Denial of Service (DoS), causing applications to crash or become unresponsive.
You can update LuaJIT by running the command 'apk add luajit=2.1_p20240815-r1' in your terminal.
References
Related vulnerabilities
Recent vulnerabilities recorded for luajit.
