[Bug 2064772] New: CVE-2021-44964 lua: use after free allows Sandbox Escape - Lua Packagers SIG - Fedora Mailing-Lists

2024

2023

2022

2021

2020

[Bug 2064772] New: CVE-2021-44964 lua: use after free allows Sandbox Escape

[Bug 2073884] New: CVE-2022-28805...

[Bug 2143391] Review Request:...

bugzilla＠redhat.com

Wednesday, 16 March 2022 Wed, 16 Mar '22

9:17 a.m.

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Bug ID: 2064772 Summary: CVE-2021-44964 lua: use after free allows Sandbox Escape Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: high Priority: high Assignee: security-response-team(a)redhat.com Reporter: pdelbell(a)redhat.com CC: 4le(a)live.com, caswilli(a)redhat.com, csutherl(a)redhat.com, drjohnson1(a)gmail.com, fedora(a)famillecollet.com, fjansen(a)redhat.com, gzaronik(a)redhat.com, hdegoede(a)redhat.com, jburrell(a)redhat.com, jclere(a)redhat.com, jwon(a)redhat.com, kaycoth(a)redhat.com, krathod(a)redhat.com, lua-packagers-sig(a)lists.fedoraproject.org, mhroncok(a)redhat.com, michel(a)michel-slm.name, moceap(a)hotmail.com, mschmidt(a)redhat.com, mturk(a)redhat.com, packaging-team-maint(a)redhat.com, pjindal(a)redhat.com, rob.myers(a)gtri.gatech.edu, spotrh(a)gmail.com, szappis(a)redhat.com Target Milestone: --- Classification: Other Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44964 https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerab... http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44964 http://lua-users.org/lists/lua-l/2021-12/msg00007.html http://lua-users.org/lists/lua-l/2021-12/msg00015.html http://lua-users.org/lists/lua-l/2021-12/msg00030.html http://lua-users.org/lists/lua-l/2021-11/msg00186.html -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

Show replies by date

bugzilla＠redhat.com

Wednesday, 16 March Wed, 16 Mar

9:17 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Patrick Del Bello <pdelbell(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2064775, 2064774 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2064774 [Bug 2064774] CVE-2021-44964 lua: use after free allows Sandbox Escape [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2064775 [Bug 2064775] CVE-2021-44964 compat-lua: lua: use after free allows Sandbox Escape [epel-all] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

9:17 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 --- Comment #1 from Patrick Del Bello <pdelbell(a)redhat.com> --- Created compat-lua tracking bugs for this issue: Affects: epel-all [bug 2064775] Created lua tracking bugs for this issue: Affects: fedora-all [bug 2064774] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Monday, 4 April Mon, 4 Apr

2:09 p.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Todd Cullum <tcullum(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2071781, 2071782 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

2:19 p.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 --- Doc Text *updated* by Todd Cullum <tcullum(a)redhat.com> --- There's a flaw in the Lua interpreter by which an attacker who is able to have a malicious script executed by the interpreter could cause a use after free that may result in sandbox escape. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

2:26 p.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Todd Cullum <tcullum(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags| |needinfo?(ffesti(a)redhat.com | |) CC| |ffesti(a)redhat.com -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Tuesday, 5 April Tue, 5 Apr

6:55 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 --- Doc Text *updated* by RaTasha Tillery-Smith <rtillery(a)redhat.com> --- A flaw was found in the Lua interpreter. This flaw allows an attacker who can have a malicious script executed by the interpreter, to cause a use-after-free issue that may result in a sandbox escape. -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

11:47 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Bug 2064772 depends on bug 2064775, which changed state. Bug 2064775 Summary: CVE-2021-44964 compat-lua: lua: use after free allows Sandbox Escape [epel-all] https://bugzilla.redhat.com/show_bug.cgi?id=2064775 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |NOTABUG -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

11:49 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Bug 2064772 depends on bug 2064774, which changed state. Bug 2064774 Summary: CVE-2021-44964 lua: use after free allows Sandbox Escape [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2064774 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |CURRENTRELEASE -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Wednesday, 6 April Wed, 6 Apr

8:24 p.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Todd Cullum <tcullum(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2072795 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Tuesday, 26 April Tue, 26 Apr

4:45 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Florian Festi <ffesti(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(ffesti(a)redhat.com | |) | -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

9:25 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Florian Festi <ffesti(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |security-response-team@redh | |at.com Flags| |needinfo?(security-response | |-team(a)redhat.com) -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

1:44 p.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Product Security DevOps Team <prodsec-dev(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(security-response |needinfo?(tcullum(a)redhat.co |-team(a)redhat.com) |m) CC| |tcullum(a)redhat.com -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Wednesday, 27 April Wed, 27 Apr

11:09 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Todd Cullum <tcullum(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Flags|needinfo?(tcullum(a)redhat.co | |m) | -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

11:10 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Todd Cullum <tcullum(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Fixed In Version| |lua 5.4.4 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Monday, 6 June Mon, 6 Jun

7:52 p.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Ravindra Patil <ravpatil(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |ravpatil(a)redhat.com -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Tuesday, 28 June Tue, 28 Jun

1:34 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Panu Matilainen <pmatilai(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pmatilai(a)redhat.com -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Wednesday, 2 November Wed, 2 Nov

6:51 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Zack Miele <zmiele(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|high |medium Priority|high |medium -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

6:57 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Zack Miele <zmiele(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |high Severity|medium |high -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Tuesday, 31 January Tue, 31 Jan

5:16 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Florian Festi <ffesti(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2165887 Referenced Bugs: https://bugzilla.redhat.com/show_bug.cgi?id=2165887 [Bug 2165887] CVE-2021-44964 lua: use after free allows Sandbox Escape [rhel-9.1.z] -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

6:42 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Bug 2064772 depends on bug 2165887, which changed state. Bug 2165887 Summary: CVE-2021-44964 lua: use after free allows Sandbox Escape [rhel-9.1.z] https://bugzilla.redhat.com/show_bug.cgi?id=2165887 What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Thursday, 2 February Thu, 2 Feb

8:03 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 RHEL Program Management Team <pgm-rhel-tools(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Depends On| |2166643 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Monday, 27 February Mon, 27 Feb

7:36 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Mauro Matteo Cascella <mcascell(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|medium |high -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

7:46 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 --- Comment #16 from Mauro Matteo Cascella <mcascell(a)redhat.com> --- Upstream fix: https://github.com/lua/lua/commit/0bfc572e51d9035a615ef6e9523f736c9ffa8e57 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Tuesday, 28 February Tue, 28 Feb

2:19 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 --- Comment #18 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2023:0957 https://access.redhat.com/errata/RHSA-2023:0957 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

2:19 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:0957 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Tuesday, 14 March Tue, 14 Mar

8:55 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 --- Comment #19 from errata-xmlrpc <errata-xmlrpc(a)redhat.com> --- This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Extended Update Support Via RHSA-2023:1211 https://access.redhat.com/errata/RHSA-2023:1211 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

8:55 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 errata-xmlrpc <errata-xmlrpc(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Link ID| |Red Hat Product Errata | |RHSA-2023:1211 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

Tuesday, 9 May Tue, 9 May

10:43 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 --- Comment #20 from Product Security DevOps Team <prodsec-dev(a)redhat.com> --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-44964 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

bugzilla＠redhat.com

10:43 a.m.

New subject: [Bug 2064772] CVE-2021-44964 lua: use after free allows Sandbox Escape

https://bugzilla.redhat.com/show_bug.cgi?id=2064772 Product Security DevOps Team <prodsec-dev(a)redhat.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |ERRATA Status|NEW |CLOSED Last Closed| |2023-05-09 15:43:57 -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2064772

Reply

346

days inactive

765

days old

lua-packagers-sig@lists.fedoraproject.org

Manage subscription

29 comments

1 participants

tags (0)

participants (1)

bugzilla＠redhat.com