Bug 1860310 (CVE-2020-15888)

Summary: CVE-2020-15888 lua: stack resizes and garbage collection leads to heap-based buffer overflow
Product: [Other] Security Response Reporter: Dhananjay Arunesh <darunesh>
Component: vulnerabilityAssignee: Florian Festi <ffesti>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: drjohnson1, ffesti, huzaifas, mdomonko, michel, packaging-team-maint, rob.myers, spotrh, vlatombe
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Lua in versions through 5.4.0. The interactions between stack resizes and garbage collections are mishandled leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. The highest threat from this vulnerability is to data confidentiality and integrity as well as data confidentiality.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-07-31 11:59:11 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1860312, 1861197, 1861198, 1861199, 1861311, 1861384, 1861385, 1910623    
Bug Blocks: 1860319    

Comment 1 Dhananjay Arunesh 2020-07-24 09:52:20 UTC
Created lua tracking bugs for this issue:

Affects: fedora-all [bug 1860312]

Comment 12 Vincent Latombe 2020-09-09 08:54:24 UTC
This affects rhel-8 as well. Why was it closed as NOTABUG?

Comment 13 Florian Festi 2020-09-09 14:51:31 UTC
Analysis has shown that the CVE does not actually apply to the code in RHEL8. In case you have a reproducer that "works" on RHEL-8 we are all too willing to re-open this issue.