Bug 1860316 (CVE-2020-15889) - CVE-2020-15889 lua: heap-based buffer over-read in lgc.c
Summary: CVE-2020-15889 lua: heap-based buffer over-read in lgc.c
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-15889
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1860317 1910622
Blocks: 1860319
TreeView+ depends on / blocked
 
Reported: 2020-07-24 10:02 UTC by Dhananjay Arunesh
Modified: 2022-04-17 20:59 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2020-07-28 04:18:04 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-07-24 10:02:23 UTC 
Lua through 5.4.0 has a getobjname heap-based buffer over-read because youngcollection in lgc.c uses markold for an insufficient number of list members.

References:
http://lua-users.org/lists/lua-l/2020-07/msg00078.html
https://github.com/lua/lua/commit/127e7a6c8942b362aa3c6627f44d660a4fb75312
Comment 1 Dhananjay Arunesh 2020-07-24 10:03:03 UTC 
Created lua tracking bugs for this issue:

Affects: fedora-all [bug 1860317]
Comment 2 Huzaifa S. Sidhpurwala 2020-07-28 04:16:59 UTC 
Statement:

The affected code was introduced via https://github.com/lua/lua/commit/f5f3df3bd17fb3489bbd26ab39fe1580a8dbf9c9 which is part of lua-5.4. Therefore versions of lua package shipped with Red Hat products is not affected by this flaw.
Note You need to log in before you can comment on or make changes to this bug.