Heap-Based Buffer Over-Read in Lua 5.4 - CVE-2021-45985
Summary
DEBIAN-CVE-2021-45985: In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. Affects lua5.4 versions < 5.4.4-1. Fixed in 5.4.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lua 5.4 is a powerful, efficient, lightweight scripting language designed for embedded use in applications. It is widely used for game development, web applications, and other software projects due to its flexibility and ease of integration. However, Lua 5.4.3 contains a vulnerability that can lead to a heap-based buffer over-read, potentially exposing sensitive data or causing application instability.
Vulnerability Detail
In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. This vulnerability can be exploited by attackers to read memory contents beyond the intended buffer, which may include sensitive information or lead to unexpected behavior in applications using Lua. The issue arises from improper handling of memory during function calls, particularly in tail call scenarios.
How To Fix
Minimum fixed version
5.4.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade lua5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using tail calls in Lua scripts until the package is updated. This may help mitigate the risk of triggering the vulnerability until a proper fix is applied.
Conclusion
CVE-2021-45985 is a critical vulnerability in Lua 5.4.3 that can lead to a heap-based buffer over-read. Users are advised to update to version 5.4.4-1 to mitigate the risk. For those unable to update immediately, avoiding tail calls can serve as a temporary measure.
See every vulnerability recorded for lua5.4 →
FAQ
CVE-2021-45985 is a vulnerability in Lua 5.4.3 that allows for a heap-based buffer over-read due to an erroneous finalizer during a tail call.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities.
The risks include potential exposure of sensitive data and application instability, which could be exploited by attackers.
Yes, the patched version is 5.4.4-1. Updating to this version will resolve the vulnerability.
If you cannot update immediately, avoid using tail calls in your Lua scripts as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for lua5.4.
