Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44964 https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44964 http://lua-users.org/lists/lua-l/2021-12/msg00007.html http://lua-users.org/lists/lua-l/2021-12/msg00015.html http://lua-users.org/lists/lua-l/2021-12/msg00030.html http://lua-users.org/lists/lua-l/2021-11/msg00186.html
Created compat-lua tracking bugs for this issue: Affects: epel-all [bug 2064775] Created lua tracking bugs for this issue: Affects: fedora-all [bug 2064774]
Upstream fix: https://github.com/lua/lua/commit/0bfc572e51d9035a615ef6e9523f736c9ffa8e57
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:0957 https://access.redhat.com/errata/RHSA-2023:0957
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:1211 https://access.redhat.com/errata/RHSA-2023:1211
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-44964