CVE-2020-24370: 
Lua vulnerability analysis and mitigation

CVE-2020-24370 affects ldebug.c in Lua 5.4.0, where a negation overflow and segmentation fault can occur in getlocal and setlocal functions, as demonstrated by getlocal(3,2^31). The vulnerability was discovered in July 2020 and affects Lua programming language versions up to 5.4.0 (Lua Users).

The vulnerability is classified as an Integer Underflow (Wrap or Wraparound) issue with a CVSS v3.1 Base Score of 5.3 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The issue occurs specifically in the findvararg function within ldebug.c, where negative values for parameter 'n' can cause unexpected behavior (NVD).

When exploited, this vulnerability can lead to a denial of service condition through segmentation faults in the affected Lua implementation. The impact is primarily limited to availability, with no direct effects on confidentiality or integrity of the system (Debian LTS).

The vulnerability can be triggered by calling the getlocal function with specific parameters, particularly getlocal(3,2^31). A proof of concept was publicly disclosed demonstrating the exploitation method (Lua Users).

A fix was released through a patch that corrects the integer overflow issue in the findvararg function. The fix has been incorporated into various distribution packages including Debian and Fedora. Users are advised to upgrade to the patched versions: Debian 9 users should upgrade to version 5.3.3-1+deb9u1, and Fedora users to version 5.3.5-8 (Debian LTS, Fedora Update).