PT-2024-24080 · Lua+1 · Lua+2

Caeleron · Published 2024-04-16 · Updated 2024-04-17 · CVE-2024-31446

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenComputers versions prior to 1.8.4 GregTech: New Horizons modpack versions prior to 1.10.10-GTNH

Description The issue allows a user to get a Computer thread stuck in the Lua VM, which eventually blocks the Server thread, requiring the server to be forcibly shut down. This can be accomplished using any device in the mod and can be performed by anyone who can execute Lua code on them. The problem occurs while using the native Lua library, but LuaJ appears to not have this issue.

Recommendations For OpenComputers versions prior to 1.8.4, update to version 1.8.4 to resolve the issue. For GregTech: New Horizons modpack versions prior to 1.10.10-GTNH, update to version 1.10.10-GTNH to apply the relevant patch. As a temporary workaround, consider restricting the execution of Lua code on devices in the mod to minimize the risk of exploitation.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-31446

GHSA-54J4-XPGJ-CQ4G

Affected Products

Gregtech: New Horizons

Lua

Opencomputers

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31446.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-31446 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31446 · Security Note
• https://github.com/MightyPirates/OpenComputers/security/advisories/GHSA-54j4-xpgj-cq4g · Note
• https://github.com/MightyPirates/OpenComputers/commit/9d4f7ea297953c2fd8ccfd24fe549d5e9576400f · Note
• https://twitter.com/cbrzeszczot/status/1780310204560605490 · Twitter Post
• https://twitter.com/CVEnew/status/1780319639865606469 · Twitter Post
• https://twitter.com/cracbot/status/1780495228002070643 · Twitter Post
• https://t.me/cvenotify/76963 · Telegram Post