CVE-2020-24370

MEDIUM EPSS 88.8%
Published Aug 17, 20205y ago · Modified Jun 17, 20262w ago
5.3 CVSS 3.1
Medium
Find Similar
Published Aug 17, 2020 5y ago
Last Modified Jun 17, 2026 2w ago

Description

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

CVSS Details

Base Score
5.3
Exploitability
3.9
Impact
1.4
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability Low

Threat Intelligence

EPSS Exploit Probability
88.8% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-191

Affected Products 20

VendorProductVersionRange
lualua5.2.0any
lualua5.2.0any
lualua5.2.0any
lualua5.2.1any
lualua5.2.2any
lualua5.2.3any
lualua5.3.0any
lualua5.3.0any
lualua5.3.0any
lualua5.3.1any
lualua5.3.2any
lualua5.3.3any
lualua5.3.4any
lualua5.3.5any
lualua5.4.0any
lualua5.4.0any
lualua5.4.0any
fedoraprojectfedora31any
fedoraprojectfedora32any
debiandebian_linux9.0any

References 6

  • lua-users.org http://lua-users.org/lists/lua-l/2020-07/msg00324.html
    ExploitMailing ListVendor Advisory
  • github.com https://github.com/lua/lua/commit/a585eae6e7ada1ca9271607a4f48dfb17868ab7b
    PatchThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2020/09/msg00019.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2023/06/msg00031.html
    Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6KONNG6UEI3FMEOY67NDZC32NBGBI44/
    Third Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXYMCIUNGK26VHAYHGP5LPW56G2KWOHQ/
    Third Party Advisory

Remediation

  • github.com https://github.com/lua/lua/commit/a585eae6e7ada1ca9271607a4f48dfb17868ab7b
    PatchThird Party Advisory