CVE-2020-24370

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Weakness

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Affected Software

Name	Vendor	Start Version	End Version
Lua	Lua	5.2.0 (including)	5.2.0 (including)
Lua	Lua	5.2.0-alpha (including)	5.2.0-alpha (including)
Lua	Lua	5.2.0-beta (including)	5.2.0-beta (including)
Lua	Lua	5.2.1 (including)	5.2.1 (including)
Lua	Lua	5.2.2 (including)	5.2.2 (including)
Lua	Lua	5.2.3 (including)	5.2.3 (including)
Lua	Lua	5.3.0 (including)	5.3.0 (including)
Lua	Lua	5.3.0-alpha (including)	5.3.0-alpha (including)
Lua	Lua	5.3.0-beta (including)	5.3.0-beta (including)
Lua	Lua	5.3.1 (including)	5.3.1 (including)
Lua	Lua	5.3.2 (including)	5.3.2 (including)
Lua	Lua	5.3.3 (including)	5.3.3 (including)
Lua	Lua	5.3.4 (including)	5.3.4 (including)
Lua	Lua	5.3.5 (including)	5.3.5 (including)
Lua	Lua	5.4.0 (including)	5.4.0 (including)
Lua	Lua	5.4.0-alpha (including)	5.4.0-alpha (including)
Lua	Lua	5.4.0-beta (including)	5.4.0-beta (including)
Red Hat Enterprise Linux 8	RedHat	lua-0:5.3.4-12.el8	*
Red Hat Enterprise Linux 8	RedHat	lua-0:5.3.4-12.el8	*
Lua5.1	Ubuntu	trusty	*
Lua5.2	Ubuntu	trusty	*
Lua5.3	Ubuntu	trusty	*
Lua5.4	Ubuntu	groovy	*
Lua5.4	Ubuntu	trusty	*
Lua50	Ubuntu	trusty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2020-24370
CWE	https://cwe.mitre.org/data/definitions/191.html

Integer Underflow (Wrap or Wraparound)

Weakness

Affected Software

References