Critical Vulnerability in Lua Package: CVE-2021-44964 - Use After Free in Garbage Collector
Summary
UBUNTU-CVE-2021-44964: Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file. Affects lua5.2 versions 5.2.2-1 – 5.2.3-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Lua is a powerful, efficient, lightweight, embeddable scripting language. It is widely used in game development, web applications, and embedded systems due to its simplicity and flexibility. The affected versions of Lua (5.2 and 5.3) are integral for various applications, providing essential functionalities for scripting. However, a critical vulnerability has been identified that compromises the security of applications utilizing these versions.
Vulnerability Detail
The vulnerability, identified as CVE-2021-44964, arises from a use-after-free condition in the garbage collector and finalizer of lgc.c in the Lua interpreter versions 5.4.0 to 5.4.3. This flaw allows attackers to exploit the garbage collection mechanism, potentially leading to a sandbox escape through crafted script files. The ramifications of this vulnerability are severe, as it could allow unauthorized access to system resources, data leakage, or execution of arbitrary code.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid executing untrusted Lua scripts or limit the execution environment to mitigate the risk of exploitation until the packages are updated.
Conclusion
The CVE-2021-44964 vulnerability poses a significant risk to applications using the affected Lua packages. It is imperative to update to the patched versions to safeguard against potential exploits. Users are encouraged to monitor their systems and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for lua5.2 →
FAQ
CVE-2021-44964 is a vulnerability in the Lua interpreter that allows attackers to perform a sandbox escape through a use-after-free condition in the garbage collector.
The vulnerability affects Lua versions 5.4.0 to 5.4.3, as well as specific packages in Ubuntu distributions.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by simply uploading your manifest file like package-lock.json.
Exploitation of this vulnerability could lead to unauthorized access, data leakage, or execution of arbitrary code, compromising the integrity of the system.
Yes, as a temporary measure, avoid executing untrusted Lua scripts or limit the execution environment until the packages are updated.
Related vulnerabilities
Recent vulnerabilities recorded for lua5.2.
