CVE-2022-28805: Critical severity Lua Lua vulnerability
Last updated 29 July 2024
Other sources
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaKexp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
— Launchpad
singlevar in lparser.c in Lua through 5.4.4 lacks a certain luaKexp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
https://lua-users.org/lists/lua-l/2022-02/msg00001.html https://lua-users.org/lists/lua-l/2022-02/msg00070.html https://lua-users.org/lists/lua-l/2022-04/msg00009.html https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/lua5.1to a version that resolves this vulnerability.Fixed in 5.1.5-9Fixed in 5.1.5-11Fixed in 5.1.5-12 - Upgrade
Upgrade
debian/lua5.2to a version that resolves this vulnerability.Fixed in 5.2.4-3Fixed in 5.2.4-4 - Upgrade
Upgrade
debian/lua5.3to a version that resolves this vulnerability.Fixed in 5.3.6-2Fixed in 5.3.6-5 - Upgrade
Upgrade
debian/lua5.4to a version that resolves this vulnerability.Fixed in 5.4.4-3+deb12u1Fixed in 5.4.7-1Fixed in 5.4.9-1Fixed in 5.4.9-2 - Upgrade
Upgrade
alpine/lua5.4to a version that resolves this vulnerability.Fixed in 5.4.3-r1 - Upgrade
Upgrade
alpine/lua5.4to a version that resolves this vulnerability.Fixed in 5.4.4-r4 - Upgrade
Upgrade
debian/lua5.4to a version that resolves this vulnerability.Fixed in 5.4.4-2
Event History
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2022-28805.
What is the severity of CVE-2022-28805?
The severity of CVE-2022-28805 is critical with a CVSS score of 9.1.
Which versions of Lua are affected by CVE-2022-28805?
Lua versions from 5.4.0 up to (excluding) 5.4.4 are affected by CVE-2022-28805.
Which systems are affected by CVE-2022-28805?
Systems with Lua versions from 5.4.0 up to (excluding) 5.4.4 are affected by CVE-2022-28805. Additionally, Fedora 35 and Fedora 36 are also affected.
How can CVE-2022-28805 be exploited?
CVE-2022-28805 can be exploited by compiling untrusted Lua code, leading to a heap-based buffer over-read.