Skip to content

Security Vulnerability - Action Required: Here is a negation overflow in lua #352

@Crispy-fried-chicken

Description

@Crispy-fried-chicken

CVE-2020-24370 is a security vulnerability in lua. Although the CVE decription in CVE-2020-24370 said that this CVE only affected lua 5.4.0, according to lua this CVE actually existed since lua 5.2. The root cause of this CVE is the negation overflow that occurs when you try to take the negative of 0x80000000. Thus, this CVE also exists in minix in the file external/mit/lua/dist/src/ldebug.c.
Maybe you should try to backport the fix to the lua in minix since the original fix is for 5.4 and several functions need to be changed. I'd like to open a PR for that if necessary.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions