Lua · Lua · CVE-2020-24370
**Name of the Vulnerable Software and Affected Versions**
Lua version 5.4.0
**Description**
The issue is related to an integer overflow in the ldebug.c component of the Lua script interpreter. This can be exploited by a remote attacker to cause a denial of service. The vulnerability is demonstrated by the getlocal(3,2^31) function call, which can lead to a negation overflow and segmentation fault in getlocal and setlocal functions.
**Recommendations**
For Lua version 5.4.0, consider disabling the getlocal and setlocal functions in the ldebug.c component as a temporary workaround until a patch is available. Restrict access to these functions to minimize the risk of exploitation. Avoid using the getlocal function with large input values, such as 2^31, until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.