CVE-2021-44964: Use After Free
Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-44964?
CVE-2021-44964 is a vulnerability that allows attackers to perform Sandbox Escape via a crafted script file in Lua interpreter versions 5.4.0 to 5.4.3.
What is the severity of CVE-2021-44964?
The severity of CVE-2021-44964 is medium, with a severity value of 6.3.
How does CVE-2021-44964 impact Lua interpreter?
CVE-2021-44964 impacts Lua interpreter by allowing attackers to perform a Sandbox Escape through a use-after-free vulnerability in the garbage collector and finalizer of lgc.c.
Which versions of Lua interpreter are affected by CVE-2021-44964?
Lua interpreter versions 5.4.0 to 5.4.3 are affected by CVE-2021-44964.
How can I mitigate the vulnerability in Lua interpreter?
To mitigate the vulnerability in Lua interpreter, update to a version beyond 5.4.3 and apply any patches or fixes provided by the Lua project.