Input validation error in Lua - CVE-2020-24371

Vulnerability identifier: #VU45993

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-24371

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.

Lua
SUSE MicroOS
SUSE Linux Enterprise Module for Basesystem
liblua5_3-5
liblua5_3-5-debuginfo
lua53-debuginfo
lua53-debugsource
lua53
lua53-devel
liblua5_3-5-32bit
liblua5_3-5-32bit-debuginfo
Dell EMC VxRail Appliance

Install update from vendor's website.

liblua5_3-5 - update to 5.3.6-3.6.1
liblua5_3-5-debuginfo - update to 5.3.6-3.6.1
lua53-debuginfo - update to 5.3.6-3.6.1
lua53-debugsource - update to 5.3.6-3.6.1
lua53 - update to 5.3.6-3.6.1
lua53-devel - update to 5.3.6-3.6.1
liblua5_3-5-32bit - update to 5.3.6-3.6.1
liblua5_3-5-32bit-debuginfo - update to 5.3.6-3.6.1
Dell EMC VxRail Appliance - update to 7.0.203

• https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110
• https://www.lua.org/bugs.html#5.4.0-9

• Multiple vulnerabilities in Lua
• SUSE update for lua53
• Multiple vulnerabilities in Dell EMC VxRail Appliance