PT-2020-15712 · Lua · Lua

Published 2020-08-17 · Updated 2025-08-03 · CVE-2020-24369

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Lua version 5.4.0

Description The issue arises in the ldebug.c file of Lua 5.4.0, where it attempts to access debug information via the line hook of a stripped function. This results in a NULL pointer dereference.

Recommendations For Lua version 5.4.0, consider updating to a newer version that addresses this issue, as accessing debug information from stripped functions can lead to crashes or other unintended behavior. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

BIT-LUA-2020-24369

CVE-2020-24369

OPENSUSE-SU-2024:11029-1

OPENSUSE-SU-2025:15401-1

Affected Products

Lua

References · 17

• 🔥 https://lua.org/bugs.html#5.4.0-12 · Exploit
• https://github.com/lua/lua/commit/ae5b5ba529753c7a653901ffc29b5ea24c3fdf3a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-24369 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24369 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-24369 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-24369 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-lua-2020-24369 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15401-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-24371 · Note
• https://suse.com/security/cve/CVE-2020-24370 · Note
• https://suse.com/security/cve/CVE-2020-24369 · Note
• https://suse.com/security/cve/CVE-2020-24342 · Note
• https://suse.com/security/cve/CVE-2020-15945 · Note
• https://suse.com/security/cve/CVE-2021-44647 · Note
• https://suse.com/security/cve/CVE-2022-33099 · Note