Heap-Based Buffer Over-Read in Lua 5.4 - CVE-2022-28805
Summary
UBUNTU-CVE-2022-28805: singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code. Affects lua5.4 versions 5.4.2-2 – 5.4.4-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lua is a powerful, efficient, lightweight, embeddable scripting language. It is widely used for game development, web applications, and as a scripting language in various software. The package lua5.4 provides version 5.4 of Lua, which includes several enhancements and optimizations. However, a vulnerability has been identified in this version that could lead to serious security issues when untrusted Lua code is executed.
Vulnerability Detail
The vulnerability, identified as CVE-2022-28805, originates from a flaw in the singlevar function within lparser.c in Lua versions from 5.4.0 up to, but not including, 5.4.4. This flaw results in a lack of a specific luaK_exp2anyregup call, which can lead to a heap-based buffer over-read. This vulnerability poses a risk to systems that compile and execute untrusted Lua code, potentially allowing attackers to exploit the buffer over-read to gain unauthorized access to sensitive information or cause application crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate patching is not possible, consider restricting the execution of untrusted Lua code or implementing additional security measures to validate and sanitize inputs before processing them with Lua.
Conclusion
CVE-2022-28805 is a critical vulnerability in Lua 5.4 that can lead to severe security implications when untrusted code is executed. It is essential to update to the patched version to protect your systems from potential exploits. For those unable to update immediately, implementing workarounds can help mitigate risks.
See every vulnerability recorded for lua5.4 →
FAQ
CVE-2022-28805 is a vulnerability in Lua 5.4 that can lead to a heap-based buffer over-read when executing untrusted Lua code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized access to sensitive information or application crashes, posing a significant security risk.
Yes, a patched version of the lua5.4 package is available. Update to version 5.4.4-1ubuntu0.1~esm1 to mitigate the risk.
If you cannot update, consider restricting the execution of untrusted Lua code and implementing input validation and sanitization.
Related vulnerabilities
Recent vulnerabilities recorded for lua5.4.
