CVE-2019-19391
📋 TL;DR
CVE-2019-19391 is a type confusion vulnerability in LuaJIT's debug.getinfo function that allows attackers to perform arbitrary memory read/write operations. This affects LuaJIT through version 2.0.5, Moonjit before 2.1.2, and other derivatives. The LuaJIT maintainer considers the debug library inherently unsafe, but many users treat this as a security vulnerability.
💻 Affected Systems
- LuaJIT
- Moonjit
- products embedding LuaJIT
📦 What is this software?
Luajit by Luajit
Moonjit by Moonjit Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution leading to complete control of affected systems.
Likely Case
Memory corruption leading to application crashes, denial of service, or limited code execution within the LuaJIT context.
If Mitigated
No impact if debug library is disabled or LuaJIT is used in sandboxed environments without untrusted code execution.
🎯 Exploit Status
Exploitation requires ability to execute Lua code with debug library access. The vulnerability is well-documented in the pull request.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: LuaJIT 2.1.0-beta3 and later, Moonjit 2.1.2 and later
Vendor Advisory: https://github.com/LuaJIT/LuaJIT/pull/526
Restart Required: Yes
Instructions:
1. Update LuaJIT to version 2.1.0-beta3 or later. 2. Update Moonjit to version 2.1.2 or later. 3. Recompile and restart all applications using the patched library.
🔧 Temporary Workarounds
Disable debug library
allRemove or disable the debug library to prevent exploitation
Remove debug library from LuaJIT build configuration or disable at runtime
Sandbox Lua execution
allRun LuaJIT in restricted environments without debug capabilities
Use Lua sandboxing libraries or run with minimal privileges
🧯 If You Can't Patch
- Disable debug library functionality completely
- Implement strict input validation and sandboxing for all Lua code execution
🔍 How to Verify
Check if Vulnerable:
Check LuaJIT version with 'luajit -v' and verify it's 2.0.5 or earlier, or check Moonjit versionCheck Version:
luajit -vVerify Fix Applied:
Verify version is LuaJIT 2.1.0-beta3+ or Moonjit 2.1.2+ and test debug.getinfo functionality📡 Detection & Monitoring
Log Indicators:
- Unexpected memory access errors
- Debug library usage in production environments
- Application crashes with memory corruption
Network Indicators:
- Unusual Lua script execution patterns
- Exploitation attempts targeting debug functions
SIEM Query:
process:luajit AND (event:crash OR memory_access_violation)