PT-2022-12269 · Lua+4 · Lua+4

김지회 · Published 2021-11-29 · Updated 2025-12-31 · CVE-2021-44964

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Lua interpreter versions 5.4.0 through 5.4.3

Description The issue is related to a use after free in the garbage collector and finalizer of lgc.c in the Lua interpreter. This allows attackers to perform a Sandbox Escape via a crafted script file.

Recommendations For Lua interpreter versions 5.4.0 through 5.4.3, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALSA-2023:0957

AZL-40979

AZL-60034

AZL-60112

AZL-9048

BIT-LUA-2021-44964

CVE-2021-44964

OESA-2022-1860

RHSA-2023:0957

RHSA-2023:1211

RHSA-2023_0957

RLSA-2023:0957

Affected Products

Almalinux

Debian

Lua

Red Hat

Rocky Linux

References · 33

• 🔥 https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability · Exploit
• 🔥 http://lua-users.org/lists/lua-l/2021-12/msg00007.html · Exploit
• 🔥 http://lua-users.org/lists/lua-l/2021-11/msg00186.html · Exploit
• http://lua-users.org/lists/lua-l/2021-12/msg00030.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-44964 · Security Note
• https://errata.rockylinux.org/RLSA-2023:0957 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-60112 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-60034 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2023-0957.html · Vendor Advisory
• https://osv.dev/vulnerability/BIT-lua-2021-44964 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-40979 · Vendor Advisory
• http://lua-users.org/lists/lua-l/2021-12/msg00015.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-44964 · Security Note
• https://osv.dev/vulnerability/AZL-9048 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-44964 · Vendor Advisory