CVE-2022-28805: Heap-based Buffer Over-read Vulnerability in the Lua Language due to Missing luaK_exp2anyregup Call

The CVE-2022-28805 is a critical security vulnerability that affects the Lua programming language from version 5.4. up to version 5.4.3. This vulnerability, which is classified as a heap-based buffer over-read, could have a significant impact on systems that compile untrusted Lua code.

In this post, we will cover the details of the vulnerability, including its root cause, affected versions, and the necessary steps to mitigate the risk associated with it. This long read will provide you with thorough background knowledge and action points to ensure the security of your Lua-based systems.

Background on the Vulnerability

The Lua programming language is a popular, lightweight scripting language often used as a scripting language for various software applications.

The vulnerability in question, CVE-2022-28805, relates to a function called singlevar within the "lparser.c" file of the Lua source code. This specific function is responsible for parsing and compiling a single variable, but it lacks a crucial luaK_exp2anyregup call, which ultimately leads to the heap-based buffer over-read that puts systems at risk.

To better understand the problem, let us review the relevant code snippet

// lparser.c
...
static int singlevaraux(FuncState *fs, TString *n, expdesc *var, int base) {
  ...
  for (;;) {
    switch (s) {
      case VLOCAL: {  /* local variable */
        ...
      }
      case VUPVAL:  /* upvalue variable */
        ...
      default: {  /* global variable */
        ...
        if (vkisinreg(s)) {
          if (base) {
            var->u.s.info = fs->freereg;  /* register for result */
            ...
            return vk;
          }
          /* missing luaK_exp2anyregup call */
        }
        ...
      }
    }
...

In this code, the program checks the variable type, and if the variable is a global variable, it enters the default case. However, this case is missing a crucial call to luaK_exp2anyreg up, which essentially ensures proper memory management and prevents over-reads.

Exploit Details

An attacker who takes advantage of this vulnerability could craft malicious Lua code that triggers the heap-based buffer over-read when compiled. This allows the attacker to potentially read sensitive information stored in the system memory or even cause a crash in the affected software.

The most significant risk factor associated with this vulnerability is for systems and applications that compile and execute untrusted Lua code from external sources. In such cases, the vulnerability can be leveraged to compromise the affected systems or disclose sensitive data.

To mitigate the risk associated with CVE-2022-28805, follow the recommendations outlined below

1. Update your Lua version: The Lua developers have already addressed this vulnerability in the latest release, Lua 5.4.4. It is highly recommended to update your Lua installation to version 5.4.4 or later. You can download the latest version from the official Lua website: https://www.lua.org/download.html

2. Review and sanitize input: If your application or system compiles untrusted Lua code, ensure that this code is thoroughly reviewed and sanitized before execution. Implement input validation and constraints to prevent the exploitation of this vulnerability.

3. Monitor systems for suspicious activity: Regularly check your systems for any signs of unauthorized access or unusual behavior that may indicate a potential exploit attempt.

Conclusion

CVE-2022-28805 is a significant security vulnerability that affects the Lua programming language with potential adverse consequences for systems that compile untrusted Lua code. By understanding the details of this vulnerability and implementing the recommended mitigation steps, you can protect your systems and ensure their continued security.

Timeline

Published on: 04/08/2022 06:15:00 UTC
Last modified on: 08/04/2022 04:15:00 UTC