CVE-2022-28805: 
Lua vulnerability analysis and mitigation

CVE-2022-28805 affects Lua versions from 5.4.0 up to (excluding) 5.4.4. The vulnerability exists in the singlevar function within lparser.c, which lacks a certain luaK_exp2anyregup call. This vulnerability was discovered in early 2022 and affects systems that compile untrusted Lua code (NVD).

The vulnerability is a heap-based buffer over-read issue in the Lua programming language. The CVSS v3.1 base score is 9.1 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. The issue specifically occurs in the singlevar function within lparser.c due to a missing luaK_exp2anyregup call (NVD, Debian).

The vulnerability can lead to a heap-based buffer over-read condition when compiling untrusted Lua code. This could potentially result in information disclosure and system availability impacts, as indicated by the high confidentiality and availability ratings in the CVSS score (NVD).

The vulnerability has been fixed in Lua version 5.4.4. Users should upgrade to this version or later. The fix involves adding the missing luaK_exp2anyregup call in the singlevar function. Various Linux distributions have released security updates to address this vulnerability (Fedora Update, Gentoo).