Heap-Buffer Overflow Vulnerability in Lua 5.4 Package
Summary
UBUNTU-CVE-2022-33099: An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. Affects lua5.4 versions 5.4.2-2 – 5.4.4-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lua is a powerful, efficient, lightweight, embeddable scripting language. It is widely used for game development, web applications, and other software projects due to its flexibility and ease of integration. The Lua 5.4 package, specifically version 5.4.4-1, is vulnerable to a heap-buffer overflow, which can lead to severe security issues.
Vulnerability Detail
The vulnerability arises from the luaG_runerror component of Lua version 5.4.4 and earlier. When a recursive error occurs, it can trigger a heap-buffer overflow, potentially allowing an attacker to execute arbitrary code or crash the application. This vulnerability is classified with a CVSS score of 7.5, indicating a high severity level. The flaw can be exploited without user interaction, making it particularly dangerous.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit the use of recursive functions in your Lua scripts to avoid triggering the vulnerability until the package is updated.
Conclusion
The heap-buffer overflow vulnerability in the Lua 5.4 package poses significant risks to applications utilizing this scripting language. It is crucial to update to the patched version to safeguard against potential exploits. Regular monitoring and vulnerability management practices, such as those offered by Vulert, can help maintain application security.
See every vulnerability recorded for lua5.4 →
FAQ
The vulnerability is a heap-buffer overflow that occurs during recursive error handling in Lua 5.4.4 and earlier versions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability can lead to arbitrary code execution or application crashes, posing significant security risks.
Yes, a patched version of the Lua package is available. Update to version 5.4.4-1ubuntu0.1~esm1 to mitigate the risk.
If immediate updates are not possible, consider limiting the use of recursive functions in your Lua scripts as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for lua5.4.
