Negation Overflow in Lua 5.4.0 Affects Local Variable Handling
CVE-2020-24370

5.3MEDIUM

Key Information:

Vendor

Lua

Status
Lua
Vendor
CVE Published:
17 August 2020

What is CVE-2020-24370?

The vulnerability in Lua 5.4.0 arises from the improper handling of local variables, specifically in the 'getlocal' and 'setlocal' functions. A negation overflow may occur when these functions are called with certain parameters, potentially leading to a segmentation fault. This vulnerability can impact the stability and security of Lua applications by allowing unintended access to memory locations and disrupting program execution.

References

http://lua-users.org/lists/lua-l/2020-07/msg00324.html
https://github.com/lua/lua/commit/a585eae6e7ada1ca9271607...
https://lists.fedoraproject.org/archives/list/package-ann...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.