CVE-2020-24372
📋 TL;DR
CVE-2020-24372 is an out-of-bounds read vulnerability in LuaJIT's error handling code that could allow attackers to read sensitive memory contents. This affects systems running LuaJIT versions through 2.1.0-beta3, potentially exposing applications that embed LuaJIT to information disclosure or crash attacks.
💻 Affected Systems
- LuaJIT
- Applications embedding LuaJIT
📦 What is this software?
Luajit by Luajit
Luajit by Luajit
Luajit by Luajit
Luajit by Luajit
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution through memory corruption leading to complete system compromise
Likely Case
Application crash (denial of service) or information disclosure of adjacent memory
If Mitigated
Limited impact with proper memory protections and sandboxing
🎯 Exploit Status
Exploitation requires triggering specific error conditions in lj_err_run function
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.0-beta4 and later
Vendor Advisory: https://github.com/LuaJIT/LuaJIT/issues/603
Restart Required: Yes
Instructions:
1. Update LuaJIT to version 2.1.0-beta4 or later
2. Recompile any applications using LuaJIT
3. Restart affected services
🔧 Temporary Workarounds
Disable LuaJIT error handling
allModify applications to avoid triggering lj_err_run error conditions
Memory protection hardening
linuxEnable ASLR and other memory protection mechanisms
sysctl -w kernel.randomize_va_space=2
🧯 If You Can't Patch
- Isolate LuaJIT applications in containers or VMs with limited privileges
- Implement network segmentation to restrict access to vulnerable services
🔍 How to Verify
Check if Vulnerable:
Check LuaJIT version with 'luajit -v' or examine application dependenciesCheck Version:
luajit -vVerify Fix Applied:
Confirm LuaJIT version is 2.1.0-beta4 or later and test error handling functionality📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory access violation errors
- Unexpected LuaJIT error messages
Network Indicators:
- Unusual traffic patterns to LuaJIT-enabled services
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "memory violation" OR "lj_err_run")