CVE-2024-25178
📋 TL;DR
This vulnerability is an out-of-bounds read in the stack-overflow handler of LuaJIT, which could allow attackers to read sensitive memory contents or potentially lead to remote code execution. It affects LuaJIT through version 2.1 and OpenResty's luajit2 fork before March 14, 2024. Any application using these vulnerable LuaJIT implementations is at risk.
💻 Affected Systems
- LuaJIT
- OpenResty luajit2
📦 What is this software?
Luajit by Luajit
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or service disruption.
Likely Case
Information disclosure through memory reads, potential denial of service, or limited code execution depending on exploitation.
If Mitigated
Limited impact with proper memory protections and exploit mitigations like ASLR and DEP.
🎯 Exploit Status
Proof-of-concept available in GitHub references. Exploitation requires ability to execute Lua code in vulnerable context.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: LuaJIT commit defe61a56751a0db5f00ff3ab7b8f45436ba74c8 or later
Vendor Advisory: https://github.com/LuaJIT/LuaJIT/issues/1152
Restart Required: Yes
Instructions:
1. Update LuaJIT to commit defe61a56751a0db5f00ff3ab7b8f45436ba74c8 or later. 2. For OpenResty, update luajit2 to v2.1-20240314 or later. 3. Rebuild and restart all affected applications.
🔧 Temporary Workarounds
Disable LuaJIT execution
allTemporarily disable LuaJIT execution in applications if possible
Application-specific configuration changes required
Sandbox Lua execution
allImplement strict sandboxing for Lua code execution
Use Lua sandboxing libraries or implement custom restrictions
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems
- Deploy application firewalls to monitor and block suspicious Lua execution patterns
🔍 How to Verify
Check if Vulnerable:
Check LuaJIT version with: luajit -vCheck Version:
luajit -vVerify Fix Applied:
Verify version shows commit defe61a56751a0db5f00ff3ab7b8f45436ba74c8 or later📡 Detection & Monitoring
Log Indicators:
- Unusual Lua execution patterns
- Stack overflow errors in LuaJIT logs
- Memory access violation logs
Network Indicators:
- Suspicious Lua code transmission to applications
SIEM Query:
source="*lua*" AND (event="stack_overflow" OR event="memory_access")🔗 References
- https://gist.github.com/pwnhacker0x18/423b4292f301ab274b42d5ed6e0b87d8
- https://github.com/LuaJIT/LuaJIT/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8
- https://github.com/LuaJIT/LuaJIT/issues/1152
- https://github.com/openresty/luajit2/commit/defe61a56751a0db5f00ff3ab7b8f45436ba74c8
- https://lists.debian.org/debian-lts-announce/2025/08/msg00022.html
- https://github.com/LuaJIT/LuaJIT/issues/1152
