CVE-2020-24372: 
Sysdig vulnerability analysis and mitigation

LuaJIT through version 2.1.0-beta3 contains an out-of-bounds read vulnerability in the lj_err_run function within lj_err.c. The vulnerability was discovered and disclosed on August 17, 2020, affecting all versions of LuaJIT up to and including version 2.1.0-beta3 (NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) with a CVSS v3.1 base score of 7.5 (High). The vulnerability is characterized by network attack vector, low attack complexity, requires no privileges or user interaction, and has an unchanged scope. While there is no impact on confidentiality or integrity, it has a high impact on availability (NVD, Ubuntu).

The vulnerability primarily affects system availability with no direct impact on confidentiality or integrity. The out-of-bounds read condition can potentially lead to system crashes or service disruptions (NVD).

The vulnerability can be triggered through untrusted Lua code execution, though it has been noted to have limited security impact. A proof of concept exists demonstrating the vulnerability through specific code execution patterns (Debian, GitHub Issue).

As of the latest reports, many distributions still list this vulnerability as unfixed in their repositories. The vulnerability affects multiple versions of Ubuntu (from 16.04 LTS to 24.04 LTS) and Debian distributions, with no official fix released (Ubuntu, Debian).