Bug 856463 (CVE-2022-33099)

Summary:	<dev-lang/lua-5.4.6: heap buffer overflow in recursive errors
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	minor	CC:	robbat2, t, williamh
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://lua-users.org/lists/lua-l/2022-05/msg00035.html
Whiteboard:	B3 [glsa? cleanup]
Package list:		Runtime testing required:	---
Bug Depends on:	914335
Bug Blocks:

Description John Helmert III archtester

2022-07-05 01:59:38 UTC

CVE-2022-33099 (https://lua-users.org/lists/lua-l/2022-05/msg00073.html):

An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.

According to the upstream changelog at https://www.lua.org/bugs.html , this was introduced in 5.4.2.

Patch on Github (which appears to not be in any tags):
https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf

Comment 1 Thomas Bracht Laumann Jespersen 2023-06-07 07:44:44 UTC

AFAICT the fix is included in releases 5.4.5 and 5.4.6.

Comment 2 John Helmert III archtester

2023-06-12 04:38:28 UTC

(In reply to Thomas Bracht Laumann Jespersen from comment #1)
> AFAICT the fix is included in releases 5.4.5 and 5.4.6.

Where are the patches?

Comment 3 Thomas Bracht Laumann Jespersen 2023-06-12 11:14:54 UTC

It should be the patch mentioned in comment 0. github indicates that it's included in 5.4.5 and 5.4.6.

Unless I'm misunderstanding, and the linked patch is the one introducing the vuln.

Comment 4 John Helmert III archtester

2023-06-18 23:36:58 UTC

Ah, indeed you're right, I hadn't noticed the patch had made it into a release, sorry!

Comment 5 Larry the Git Cow gentoo-dev

2023-07-16 10:32:30 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=66baf9c626901c7195a3f6e136e60dd1a562ea4d

commit 66baf9c626901c7195a3f6e136e60dd1a562ea4d
Author:     David Seifert <soap@gentoo.org>
AuthorDate: 2023-07-16 10:32:22 +0000
Commit:     David Seifert <soap@gentoo.org>
CommitDate: 2023-07-16 10:32:22 +0000

    dev-lang/lua: add 5.4.6
    
    Bug: https://bugs.gentoo.org/856463
    Signed-off-by: David Seifert <soap@gentoo.org>

 dev-lang/lua/Manifest         |  1 +
 dev-lang/lua/lua-5.4.6.ebuild | 50 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)

Comment 6 John Helmert III archtester

2023-11-21 04:00:32 UTC

Hm, presumably the older branches are affected too, though?