CVE-2024-25176
📋 TL;DR
This CVE describes a stack buffer overflow vulnerability in LuaJIT's string formatting function (lj_strfmt_wfnum). Attackers can exploit this to execute arbitrary code or cause denial of service. Affected systems include any software using vulnerable versions of LuaJIT or OpenResty's luajit2.
💻 Affected Systems
- LuaJIT
- OpenResty luajit2
📦 What is this software?
Luajit by Luajit
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Denial of service crashes affecting LuaJIT-dependent applications and services.
If Mitigated
Limited impact with proper memory protections (ASLR, DEP) and sandboxing.
🎯 Exploit Status
Proof-of-concept available in references. Exploitation requires triggering the vulnerable string formatting function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: LuaJIT commit 343ce0edaf3906a62022936175b2f5410024cbfc, OpenResty luajit2 v2.1-20240626
Vendor Advisory: https://github.com/LuaJIT/LuaJIT/issues/1149
Restart Required: Yes
Instructions:
1. Update LuaJIT to latest version with commit 343ce0edaf3906a62022936175b2f5410024cbfc. 2. For OpenResty, update luajit2 to v2.1-20240626 or later. 3. Rebuild and restart affected applications.
🔧 Temporary Workarounds
Disable vulnerable string formatting
allRestrict or sanitize inputs to LuaJIT string formatting functions
# No direct command - requires code changes to avoid lj_strfmt_wfnum usage
🧯 If You Can't Patch
- Implement strict input validation for all LuaJIT string formatting operations
- Deploy memory protection controls (ASLR, DEP) and sandbox LuaJIT execution
🔍 How to Verify
Check if Vulnerable:
Check LuaJIT version with 'luajit -v' and compare against affected versions. Review application dependencies for LuaJIT usage.Check Version:
luajit -vVerify Fix Applied:
Verify LuaJIT version is after commit 343ce0edaf3906a62022936175b2f5410024cbfc. Test string formatting functions with edge cases.📡 Detection & Monitoring
Log Indicators:
- Segmentation faults in LuaJIT processes
- Abnormal memory access patterns in application logs
Network Indicators:
- Unusual traffic to LuaJIT-enabled services triggering crashes
SIEM Query:
process_name:"luajit" AND (event_type:"crash" OR memory_violation)🔗 References
- https://gist.github.com/pwnhacker0x18/cd75d01fc7c9b6c85c183fbe5353d276
- https://github.com/LuaJIT/LuaJIT/commit/343ce0edaf3906a62022936175b2f5410024cbfc
- https://github.com/LuaJIT/LuaJIT/issues/1149
- https://github.com/openresty/luajit2/commit/343ce0edaf3906a62022936175b2f5410024cbfc
- https://lists.debian.org/debian-lts-announce/2025/08/msg00022.html
- https://github.com/LuaJIT/LuaJIT/issues/1149
