PT-2020-15693 · Lua · Lua

Roberto-Ieru · Published 2020-08-13 · Updated 2025-08-03 · CVE-2020-24342

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lua versions prior to 5.4.1

Description The issue allows a stack redzone cross in luaO pushvfstring due to a protection mechanism wrongly calling luaD callnoyield twice in a row.

Recommendations For Lua versions prior to 5.4.1, update to version 5.4.1 or later to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BIT-LUA-2020-24342

CVE-2020-24342

OPENSUSE-SU-2024:11029-1

OPENSUSE-SU-2025:15401-1

Affected Products

Lua

References · 18

• 🔥 http://lua-users.org/lists/lua-l/2020-07/msg00052.html · Exploit
• https://github.com/lua/lua/commit/34affe7a63fc5d842580a9f23616d057e17dfe27 · Patch
• https://osv.dev/vulnerability/CVE-2020-24342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24342 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QA5Q5MDQMTGXRQO3PAQ4EZFTYWJXZM5N · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-24342 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-lua-2020-24342 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15401-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24342 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-24371 · Note
• https://suse.com/security/cve/CVE-2020-24370 · Note
• https://suse.com/security/cve/CVE-2020-24369 · Note
• https://suse.com/security/cve/CVE-2020-24342 · Note
• https://suse.com/security/cve/CVE-2020-15945 · Note
• https://suse.com/security/cve/CVE-2021-44647 · Note