CVE-2021-44964

Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.
References
Link Resource
http://lua-users.org/lists/lua-l/2021-11/msg00186.html Exploit Mailing List Technical Description Vendor Advisory
http://lua-users.org/lists/lua-l/2021-12/msg00007.html Exploit Mailing List Vendor Advisory
http://lua-users.org/lists/lua-l/2021-12/msg00015.html Mailing List Vendor Advisory
http://lua-users.org/lists/lua-l/2021-12/msg00030.html Mailing List Vendor Advisory
https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lua:lua:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-03-14 15:15

Updated : 2024-02-28 19:09


NVD link : CVE-2021-44964

Mitre link : CVE-2021-44964

CVE.ORG link : CVE-2021-44964


JSON object : View

Products Affected

lua

  • lua
CWE
CWE-416

Use After Free