Heap-based buffer overflow in Lua - CVE-2022-28805

Vulnerability identifier: #VU62053

CSH Severity: High

CVSS v4 BT: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-28805

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the singlevar function in lparser.c. A remote attacker can use a specially crafted luaK_exp2anyregup call, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Lua
Oracle Linux
Gentoo Linux
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Oracle Solaris
openEuler
Ubuntu
Fedora
OpenShift sandboxed containers
Harbor
OpenShift Data Foundation (formerly OpenShift Container Storage)
cert-manager Operator for Red Hat OpenShift
Red Hat OpenShift Dev Spaces
App Connect Enterprise Certified Container
Red Hat OpenShift Container Platform
lua5.4 (Ubuntu package)
lua
lua-debuginfo
lua-debugsource
lua-devel
lua-help
lua (Red Hat package)
Network Observability plugin for the Openshift Console

Install update from vendor's website.

OpenShift sandboxed containers - update to 1.4.1
cert-manager Operator for Red Hat OpenShift - update to 1.10.3
Harbor - update to 1.10.11
Red Hat OpenShift Container Platform - update to 4.13.2
lua5.4 (Ubuntu package) - update to Ubuntu Pro
Network Observability plugin for the Openshift Console - update to 1.3.0
Red Hat OpenShift Dev Spaces - update to 3.15.0
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
lua - update to 5.4.3-6
lua-debuginfo - update to 5.4.3-6
lua-debugsource - update to 5.4.3-6
lua-devel - update to 5.4.3-6
lua-help - update to 5.4.3-6
lua (Red Hat package) - update to 5.4.4-3.el9
lua - addressed in versions 5.4.4-3.fc35, 5.4.4-3.fc36
App Connect Enterprise Certified Container - update to 7.0.0

• https://lua-users.org/lists/lua-l/2022-02/msg00001.html
• https://lua-users.org/lists/lua-l/2022-02/msg00070.html
• https://lua-users.org/lists/lua-l/2022-04/msg00009.html
• https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa

• Heap-based buffer overflow in Lua
• Multiple vulnerabilities in Harbor
• Gentoo update for Lua
• Red Hat Enterprise Linux 9 update for lua
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Network Observability plugin for the Openshift Console
• Heap-based buffer overflow in IBM App Connect Enterprise Certified Container Dashboard
• Multiple vulnerabilities in OpenShift sandboxed containers 1.4
• Multiple vulnerabilities in cert-manager Operator for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Container Platform release 4.13
• openEuler 22.03 LTS update for lua
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Ubuntu update for lua5.4
• Fedora 36 update for lua
• Fedora 35 update for lua