Critical Out-of-Bounds Read Vulnerability in LuaJIT Package
Summary
ALPINE-CVE-2024-25178: LuaJIT through 2.1 and OpenRusty luajit2 before v2.1-20240314 have an out-of-bounds read in the stack-overflow handler in lj_state.c. Affects luajit versions < 2.1_p20240815-r1. Fixed in 2.1_p20240815-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LuaJIT is a Just-In-Time Compiler for the Lua programming language, designed to enhance performance by compiling Lua code into machine code. It is widely used in various applications for its speed and efficiency. However, it has recently been discovered that LuaJIT versions up to 2.1 and OpenRusty luajit2 before v2.1-20240314 are susceptible to an out-of-bounds read vulnerability, which can lead to potential security risks.
Vulnerability Detail
The vulnerability arises from an out-of-bounds read in the stack-overflow handler located in lj_state.c. This flaw can be exploited by attackers to read memory locations that they should not have access to, potentially leading to information disclosure or application crashes. The issue affects multiple versions of the LuaJIT package across various Alpine Linux distributions, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
2.1_p20240815-r1
This is the first release that contains the fix.
sudo apk add --upgrade luajitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected versions of LuaJIT until they can apply the patch. Additionally, consider using alternative Lua implementations that do not exhibit this vulnerability.
Conclusion
The out-of-bounds read vulnerability in LuaJIT poses significant risks to applications utilizing this package. It is crucial for users to update to the patched version to safeguard their systems. By staying informed and utilizing tools like Vulert, developers can effectively manage and mitigate vulnerabilities in their software.
See every vulnerability recorded for luajit →
FAQ
LuaJIT is a Just-In-Time Compiler for the Lua programming language, enhancing its performance by compiling Lua code into machine code.
It allows attackers to read memory locations outside the intended bounds, potentially leading to information disclosure or application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Update the LuaJIT package to version 2.1_p20240815-r1 using the command 'apk add luajit=2.1_p20240815-r1' to mitigate the vulnerability.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for luajit.
