Vulnerability Description
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Lua | Lua | >= 5.4.0, < 5.4.5 |
| Fedoraproject | Fedora | 35 |
Related Weaknesses (CWE)
References
- https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030faPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lua-users.org/lists/lua-l/2022-02/msg00001.htmlExploitMailing ListThird Party Advisory
- https://lua-users.org/lists/lua-l/2022-02/msg00070.htmlExploitMailing ListThird Party Advisory
- https://lua-users.org/lists/lua-l/2022-04/msg00009.htmlExploitMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202305-23Third Party Advisory
- https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030faPatchThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lua-users.org/lists/lua-l/2022-02/msg00001.htmlExploitMailing ListThird Party Advisory
- https://lua-users.org/lists/lua-l/2022-02/msg00070.htmlExploitMailing ListThird Party Advisory
- https://lua-users.org/lists/lua-l/2022-04/msg00009.htmlExploitMailing ListThird Party Advisory
- https://security.gentoo.org/glsa/202305-23Third Party Advisory
FAQ
What is CVE-2022-28805?
CVE-2022-28805 is a vulnerability with a CVSS score of 9.1 (CRITICAL). singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles u...
How severe is CVE-2022-28805?
CVE-2022-28805 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-28805?
Check the references section above for vendor advisories and patch information. Affected products include: Lua Lua, Fedoraproject Fedora.