SB2020101806 - Multiple vulnerabilities in Lua

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2020-15889)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to getobjname heap-based buffer over-read within the youngcollection() function in lgc.c that uses markold for an insufficient number of list members. A remote attacker can perform a denial of service attack.

2) Heap-based buffer overflow (CVE-ID: CVE-2020-15888)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error during interaction between stack resizes and garbage collection in ldo.c file. A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

3) Memory corruption (CVE-ID: CVE-2020-15945)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a segmentation fault in changedline in ldebug.c (e.g., when called by luaG_traceexec) because it incorrectly expects that an oldpc value is always updated upon a return of the flow of control to a function. A remote attacker can pass specially crafted data to the application and crash it.

4) Buffer overflow (CVE-ID: CVE-2020-24342)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row. A remote attacker can pass specially crafted data to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• http://lua-users.org/lists/lua-l/2020-07/msg00078.html
• https://github.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312
• http://lua-users.org/lists/lua-l/2020-07/msg00053.html
• http://lua-users.org/lists/lua-l/2020-07/msg00054.html
• http://lua-users.org/lists/lua-l/2020-07/msg00071.html
• http://lua-users.org/lists/lua-l/2020-07/msg00079.html
• https://github.com/lua/lua/commit/6298903e35217ab69c279056f925fb72900ce0b7
• https://github.com/lua/lua/commit/eb41999461b6f428186c55abd95f4ce1a76217d5
• http://lua-users.org/lists/lua-l/2020-07/msg00123.html
• https://github.com/lua/lua/commit/a2195644d89812e5b157ce7bac35543e06db05e3
• http://lua-users.org/lists/lua-l/2020-07/msg00052.html
• https://github.com/lua/lua/commit/34affe7a63fc5d842580a9f23616d057e17dfe27