SB2023022860 - Denial of service in Lua interpreter

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2021-44964)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error in garbage collector and finalizer of lgc.c. A remote attacker can pass specially crafted script file to the application, trigger a use-after-free error and perform a denial of service (DoS) attack.

2) Type Confusion (CVE-ID: CVE-2021-44647)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a type confusion error within the funcnamefromcode() function in ldebug.c. A remote attacker can pass specially crafted data to the application, trigger a type confusion error and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• http://lua-users.org/lists/lua-l/2021-12/msg00030.html
• http://lua-users.org/lists/lua-l/2021-12/msg00015.html
• https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability
• http://lua-users.org/lists/lua-l/2021-11/msg00186.html
• http://lua-users.org/lists/lua-l/2021-12/msg00007.html
• http://lua-users.org/lists/lua-l/2021-11/msg00204.html
• http://lua-users.org/lists/lua-l/2021-11/msg00195.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3EMGAQ5Y6GXJLY4K5DUOOEQT4MZ4J4F/
• https://access.redhat.com/security/cve/cve-2021-44647