Bug 2073884 (CVE-2022-28805)

Summary:	CVE-2022-28805 lua: heap buffer overread
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	4le, csutherl, drjohnson1, gzaronik, jclere, jwon, lua-packagers-sig, mhroncok, michel, mschmidt, mturk, packaging-team-maint, pjindal, rob.myers, spotrh, szappis
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A heap buffer-overflow vulnerability was found in Lua. The flaw occurs due to vulnerable code present in the lparser.c function of Lua that allows the execution of untrusted Lua code into a system, resulting in malicious activity.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-05-09 15:45:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2073889, 2074542
Bug Blocks:	2073886

Description Avinash Hanwate 2022-04-11 04:04:28 UTC

singlevar in lparser.c in Lua through 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.

https://lua-users.org/lists/lua-l/2022-02/msg00001.html
https://lua-users.org/lists/lua-l/2022-02/msg00070.html
https://lua-users.org/lists/lua-l/2022-04/msg00009.html
https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa

Comment 1 Avinash Hanwate 2022-04-11 04:21:49 UTC

Created lua tracking bugs for this issue:

Affects: fedora-all [bug 2073889]

Comment 4 errata-xmlrpc 2023-05-09 08:01:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:2582 https://access.redhat.com/errata/RHSA-2023:2582

Comment 5 Product Security DevOps Team 2023-05-09 15:45:03 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-28805