lua5.3: CVE-2019-6706

Debian Bug report logs - #920321
lua5.3: CVE-2019-6706

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: lua5.3: CVE-2019-6706

Date: Thu, 24 Jan 2019 07:02:59 +0100

Source: lua5.3
Version: 5.3.3-1.1
Severity: important
Tags: security upstream
Control: found -1 5.3.3-1

Hi,

The following vulnerability was published for lua5.3.

CVE-2019-6706[0]:
| Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For
| example, a crash outcome might be achieved by an attacker who is able
| to trigger a debug.upvaluejoin call in which the arguments have certain
| relationships.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-6706
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-6706

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #12 received at 920321@bugs.debian.org (full text, mbox, reply):

From: Moritz Mühlenhoff <jmm@inutil.org>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: leo.barbosa@canonical.com, 920321@bugs.debian.org

Subject: Re: lua5.3: CVE-2019-6706

Date: Mon, 8 Apr 2019 20:29:47 +0200

On Thu, Jan 24, 2019 at 07:02:59AM +0100, Salvatore Bonaccorso wrote:
> Source: lua5.3
> Version: 5.3.3-1.1
> Severity: important
> Tags: security upstream
> Control: found -1 5.3.3-1
> 
> Hi,
> 
> The following vulnerability was published for lua5.3.
> 
> CVE-2019-6706[0]:
> | Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For
> | example, a crash outcome might be achieved by an attacker who is able
> | to trigger a debug.upvaluejoin call in which the arguments have certain
> | relationships.

Ubuntu fixed this via https://launchpad.net/ubuntu/+source/lua5.3/5.3.3-1ubuntu0.18.10.1 :
http://launchpadlibrarian.net/417853567/lua5.3_5.3.3-1_5.3.3-1ubuntu0.18.10.1.diff.gz

Leonidas, what's the provenance of that patch (given that upstream doesn't
have a public code repo), has it been reviewed/blessed by the Lua upstream
developers?

Cheers,
        Moritz

Message #17 received at 920321@bugs.debian.org (full text, mbox, reply):

From: "Leonidas S. Barbosa" <leo.barbosa@canonical.com>

To: Moritz Mühlenhoff <jmm@inutil.org>, Salvatore Bonaccorso <carnil@debian.org>

Cc: 920321@bugs.debian.org

Subject: Re: lua5.3: CVE-2019-6706

Date: Mon, 08 Apr 2019 20:00:06 -0300

[Message part 1 (text/plain, inline)]

Hi, 

Yep, my bad not had added any info on the patch...said that

The patch can be find here [1]
It was tested against the POC and it fixed the issue.
Any other question, please let me know :)


[1] http://lua.2524044.n2.nabble.com/CVE-2019-6706-use-after-free-in-lu
a-upvaluejoin-function-tc7685575.html


Cheers!


On Seg, 2019-04-08 at 20:29 +0200, Moritz Mühlenhoff wrote:
> On Thu, Jan 24, 2019 at 07:02:59AM +0100, Salvatore Bonaccorso wrote:
> > 
> > Source: lua5.3
> > Version: 5.3.3-1.1
> > Severity: important
> > Tags: security upstream
> > Control: found -1 5.3.3-1
> > 
> > Hi,
> > 
> > The following vulnerability was published for lua5.3.
> > 
> > CVE-2019-6706[0]:
> > > 
> > > Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For
> > > example, a crash outcome might be achieved by an attacker who is
> > > able
> > > to trigger a debug.upvaluejoin call in which the arguments have
> > > certain
> > > relationships.
> Ubuntu fixed this via https://launchpad.net/ubuntu/+source/lua5.3/5.3
> .3-1ubuntu0.18.10.1 :
> http://launchpadlibrarian.net/417853567/lua5.3_5.3.3-1_5.3.3-1ubuntu0
> .18.10.1.diff.gz
> 
> Leonidas, what's the provenance of that patch (given that upstream
> doesn't
> have a public code repo), has it been reviewed/blessed by the Lua
> upstream
> developers?
> 
> Cheers,
>         Moritz

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.