Vulnerability Details : CVE-2020-24370
Potential exploit
ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).
Vulnerability category: Memory Corruption
Products affected by CVE-2020-24370
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.4.0:-:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.2.0:-:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.3.0:-:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.2.0:alpha:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.2.0:beta:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.3.0:alpha:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.3.0:beta:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.4.0:alpha:*:*:*:*:*:*
- cpe:2.3:a:lua:lua:5.4.0:beta:*:*:*:*:*:*
Threat overview for CVE-2020-24370
Top countries where our scanners detected CVE-2020-24370
Top open port discovered on systems with this issue
80
IPs affected by CVE-2020-24370 2
Find out if you* are
affected by CVE-2020-24370!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2020-24370
0.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 68 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-24370
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:N/I:N/A:P |
10.0
|
2.9
|
NIST | |
5.3
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
3.9
|
1.4
|
NIST |
CWE ids for CVE-2020-24370
-
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-24370
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E6KONNG6UEI3FMEOY67NDZC32NBGBI44/
[SECURITY] Fedora 31 Update: lua-5.3.5-8.fc31 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6KONNG6UEI3FMEOY67NDZC32NBGBI44/
[SECURITY] Fedora 31 Update: lua-5.3.5-8.fc31 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
http://lua-users.org/lists/lua-l/2020-07/msg00324.html
Segmentation fault in lua_getlocalExploit;Mailing List;Vendor Advisory
-
https://github.com/lua/lua/commit/a585eae6e7ada1ca9271607a4f48dfb17868ab7b
Fixed bug: Negation overflow in getlocal/setlocal · lua/lua@a585eae · GitHubPatch;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXYMCIUNGK26VHAYHGP5LPW56G2KWOHQ/
[SECURITY] Fedora 32 Update: lua-5.3.5-8.fc32 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://lists.debian.org/debian-lts-announce/2020/09/msg00019.html
[SECURITY] [DLA 2381-1] lua5.3 security updateMailing List;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QXYMCIUNGK26VHAYHGP5LPW56G2KWOHQ/
[SECURITY] Fedora 32 Update: lua-5.3.5-8.fc32 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
-
https://lists.debian.org/debian-lts-announce/2023/06/msg00031.html
[SECURITY] [DLA 3469-1] lua5.3 security updateThird Party Advisory
Jump to