Heap-based buffer overflow in Lua - CVE-2022-33099

Vulnerability identifier: #VU68952

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33099

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the luaG_runerror component. A remote attacker can send specially crafted data to the application, trigger a heap-based buffer overflow and perform a denial of service (DoS) attack.

Lua
Oracle Linux
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Oracle Solaris
openEuler
Ubuntu
Fedora
NetObserv Operator
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
lua5.4 (Ubuntu package)
lua (Red Hat package)
lua
lua-devel
lua-debugsource
lua-debuginfo
lua-help
OpenShift Data Foundation (formerly OpenShift Container Storage)

Install update from vendor's website.

NetObserv Operator - update to 1.1.0
lua5.4 (Ubuntu package) - update to Ubuntu Pro
OpenShift Data Foundation (formerly OpenShift Container Storage) - update to 4.13.0
lua (Red Hat package) - update to 5.4.2-4.el9_0.3
lua - update to 5.4.3-7
lua-devel - update to 5.4.3-7
lua-debugsource - update to 5.4.3-7
lua-debuginfo - update to 5.4.3-7
lua-help - update to 5.4.3-7
lua - addressed in versions 5.4.4-3.fc35, 5.4.4-3.fc36

• https://lua-users.org/lists/lua-l/2022-05/msg00073.html
• https://lua-users.org/lists/lua-l/2022-05/msg00042.html
• https://www.lua.org/bugs.html#Lua-stack%20overflow%20when%20C%20stack%20overflows%20while%20handling%20an%20error:~:text=Lua%2Dstack%20overflow%20when%20C%20stack%20overflows%20while%20handling%20an%20error
• https://lua-users.org/lists/lua-l/2022-05/msg00035.html
• https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RJNJ66IFDUKWJJZXHGOLRGIA3HWWC36R/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA/

• Heap-based buffer overflow in Lua
• Red Hat Enterprise Linux 9 update for lua
• Multiple vulnerabilities in NetObserv Operator
• Multiple vulnerabilities in Red Hat OpenShift Data Foundation 4.13
• Multiple vulnerabilities in Oracle Solaris third-party software
• Multiple vulnerabilities in Oracle Linux
• openEuler 22.03 LTS update for lua
• Ubuntu update for lua5.4
• Fedora 36 update for lua
• Fedora 35 update for lua