CVE-2021-43519

Published: 9 November 2021

Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1.0~5.4.4 allows attackers to perform a Denial of Service via a crafted script file.

Notes

lua deprecated from grub on 2009-09-26
debian/grub-extras/lua/ not compiled-see debian/rules and GRUB_CONTRIB
contrary to description, vulnerability appears to be introduced after 5.1

for ceph , that ships with lua, lua affected is 5.4 up, for focal
it is using 5.3 , so not-affected. Also, code not found.

SUSE bug says "this bug is only present in Lua 5.4.2 and 5.4.3"
and the PoC crashing earlier versions may be unrelated to this
CVE.

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43519
• http://lua-users.org/lists/lua-l/2021-11/msg00015.html
• http://lua-users.org/lists/lua-l/2021-10/msg00123.html
• https://github.com/lua/lua/commit/74d99057a5146755e737c479850f87fd0e3b6868
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2021-43519