Negation Overflow and Segmentation Fault in Lua 5.4.0 - CVE-2020-24370
Summary
CVE-2020-24370: ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). Affects lua5.3 across 2 version ranges.
< 5.3.3-1.1+deb11u1
< a585eae6e7ada1ca9271607a4f48dfb17868ab7b
Fixed in 5.3.3-1.1+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lua is a powerful, efficient, lightweight, embeddable scripting language. It is widely used for game development, web applications, and embedded systems. Lua 5.4.0 introduced several new features and improvements, but it also introduced a critical vulnerability that allows for negation overflow and segmentation faults in the getlocal and setlocal functions, particularly when using extreme values.
Vulnerability Detail
The vulnerability CVE-2020-24370 arises from a negation overflow that occurs in the Lua 5.4.0 implementation of the getlocal and setlocal functions. This issue can be triggered by calling getlocal with a specific argument, such as getlocal(3, 2^31), which leads to a segmentation fault. The ramifications of this vulnerability include potential crashes of applications using Lua, leading to denial of service and possible exploitation by attackers to execute arbitrary code.
How To Fix
Minimum fixed version
5.3.3-1.1+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lua5.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the getlocal and setlocal functions with extreme values that could trigger the overflow. Implement input validation to ensure that arguments passed to these functions are within safe limits.
Conclusion
CVE-2020-24370 is a significant vulnerability in Lua 5.4.0 that can lead to application crashes and potential exploitation. It is crucial for developers and users of Lua to update their packages to the latest versions to mitigate this risk. Additionally, implementing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for lua5.3 →
FAQ
CVE-2020-24370 is a vulnerability in Lua 5.4.0 that allows for negation overflow and segmentation faults in the getlocal and setlocal functions.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The vulnerability can lead to application crashes and potential denial of service, allowing attackers to exploit the flaw for malicious purposes.
Yes, upgrading to Lua versions 5.3.3-1.1+deb11u1 or 5.4.1-1 will resolve the vulnerability.
The CVSS score for CVE-2020-24370 is 5.3, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for lua5.3.
