Bug 1860310 (CVE-2020-15888) - CVE-2020-15888 lua: stack resizes and garbage collection leads to heap-based buffer overflow
Summary: CVE-2020-15888 lua: stack resizes and garbage collection leads to heap-based ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-15888
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Florian Festi
QA Contact:
URL:
Whiteboard:
Depends On: 1860312 1861197 1861198 1861199 1861311 1861384 1861385
Blocks: 1860319
TreeView+ depends on / blocked
 
Reported: 2020-07-24 09:48 UTC by Dhananjay Arunesh
Modified: 2020-09-17 06:29 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Lua in versions through 5.4.0. The interactions between stack resizes and garbage collections are mishandled leading to a heap-based buffer overflow, heap-based buffer over-read, or use-after-free. The highest threat from this vulnerability is to data confidentiality and integrity as well as data confidentiality.
Clone Of:
Environment:
Last Closed: 2020-07-31 11:59:11 UTC


Attachments (Terms of Use)

Comment 1 Dhananjay Arunesh 2020-07-24 09:52:20 UTC
Created lua tracking bugs for this issue:

Affects: fedora-all [bug 1860312]

Comment 12 Vincent Latombe 2020-09-09 08:54:24 UTC
This affects rhel-8 as well. Why was it closed as NOTABUG?

Comment 13 Florian Festi 2020-09-09 14:51:31 UTC
Analysis has shown that the CVE does not actually apply to the code in RHEL8. In case you have a reproducer that "works" on RHEL-8 we are all too willing to re-open this issue.


Note You need to log in before you can comment on or make changes to this bug.