CVE-2020-24371: 
Lua vulnerability analysis and mitigation

CVE-2020-24371 affects Lua 5.4.0, specifically in the lgc.c file where it mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage. The vulnerability was discovered and disclosed on August 17, 2020 (NVD, MITRE).

The vulnerability exists in the garbage collection mechanism of Lua 5.4.0, specifically in the interaction between barriers and the sweep phase. The issue occurs when barriers are active during the sweep phase, even in generational mode. Although generational mode is not incremental, it can hit a barrier when deleting a thread and closing its upvalues. The colors of objects are being changed during sweep and therefore cannot be trusted (LUA_BUGS, LUA_COMMIT). The vulnerability has a CVSS v3.1 Base Score of 5.3 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) (NVD).

The vulnerability can result in memory access violations when using the collectgarbage function. This can potentially lead to program crashes and availability issues in applications using the affected Lua version (NVD).

The vulnerability requires no special privileges or user interaction to exploit, and can be triggered through the normal use of the collectgarbage function in specific scenarios involving thread deletion and upvalue closure (NVD).

The issue has been fixed in later versions of Lua through a patch that prevents barriers from being active during the sweep phase. The fix involves modifications to the lgc.c file to properly handle the interaction between barriers and the sweep phase (LUA_COMMIT). Users should upgrade to a version of Lua newer than 5.4.0.