CVE-2020-24369: 
Lua vulnerability analysis and mitigation

ldebug.c in Lua 5.4.0 attempts to access debug information via the line hook of a stripped function, leading to a NULL pointer dereference. The vulnerability was discovered and disclosed in August 2020, affecting Lua version 5.4.0. This security issue is tracked as CVE-2020-24369 and has been assigned a CVSS v3.1 base score of 7.5 HIGH (NVD).

The vulnerability occurs in the ldebug.c file of Lua 5.4.0 when attempting to access debug information through the line hook functionality of a stripped function. The issue specifically manifests when the code tries to access debug information without properly checking whether it is present, resulting in a NULL pointer dereference. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 HIGH, with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can lead to a NULL pointer dereference, which typically results in program termination. This can cause a denial of service condition in applications running the affected Lua version. The impact is particularly significant for network-accessible applications that use Lua's debugging features (Oracle Bulletin).

The vulnerability can be triggered when debug hooks are used with stripped functions (functions without debug information). A proof-of-concept exploit demonstrates that the issue can be reproduced by setting a line hook on a stripped function (Lua Bugs).

The vulnerability was fixed in subsequent versions of Lua. The fix involves adding proper checks for the presence of debug information before attempting to access it. A patch was committed that modifies the changedline function in ldebug.c to check if p->lineinfo is NULL before accessing debug information (Lua Patch).