PT-2022-21690 · Lua+7 · Lua+7

Roberto-Ieru · Published 2022-07-01 · Updated 2025-08-03 · CVE-2022-33099

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Lua versions prior to 5.4.4

Description An issue in the component luaG runerror of Lua leads to a heap-buffer overflow when a recursive error occurs.

Recommendations For versions prior to 5.4.4, update to a version that contains a fix for this issue. As a temporary workaround, consider implementing error handling mechanisms to prevent recursive errors that could lead to a heap-buffer overflow.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2022:7329

ALT-PU-2024-3994

AZL-10045

AZL-35032

AZL-41192

BIT-LUA-2022-33099

CVE-2022-33099

OESA-2022-1764

OPENSUSE-SU-2024:12167-1

OPENSUSE-SU-2025:15401-1

RHSA-2022:7329

RHSA-2022_7329

RLSA-2022:7329

USN-6916-1

Affected Products

Alt Linux

Almalinux

Debian

Linuxmint

Lua

Red Hat

Rocky Linux

Ubuntu

References · 48

• 🔥 https://lua.org/bugs.html#Lua-stack%20overflow%20when%20C%20stack%20overflows%20while%20handling%20an%20error:~:text=Lua%2Dstack%20overflow%20when%20C%20stack%20overflows%20while%20handling%20an%20error · Exploit
• 🔥 https://lua-users.org/lists/lua-l/2022-05/msg00042.html · Exploit
• 🔥 https://lua-users.org/lists/lua-l/2022-05/msg00073.html · Exploit
• 🔥 https://lua-users.org/lists/lua-l/2022-05/msg00035.html · Exploit
• https://github.com/lua/lua/commit/42d40581dd919fb134c07027ca1ce0844c670daf · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-33099 · Security Note
• https://osv.dev/vulnerability/AZL-10045 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UHYZOEFDVLVAD6EEP4CDW6DNONIVVHPA · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-33099 · Security Note
• https://ubuntu.com/security/CVE-2022-28805 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-6916-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-lua-2022-33099 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35032 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15401-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2022-7329.html · Vendor Advisory