LuaJIT up to 2.0.5 type confusion ⚔ [Disputed]

Summaryinfo

A vulnerability, which was classified as critical, was found in LuaJIT up to 2.0.5. Affected by this issue is some unknown functionality. Executing a manipulation can lead to type confusion. The identification of this vulnerability is CVE-2019-19391. The attack may be launched remotely. There is no exploit available. The existence of this vulnerability is still disputed at present.

Detailsinfo

A vulnerability was found in LuaJIT up to 2.0.5. It has been declared as critical. This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a type confusion vulnerability. The CWE definition for the vulnerability is CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In LuaJIT through 2.0.5, as used in Moonjit before 2.1.2 and other products, debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations, because certain cases involving valid stack levels and > options are mishandled. NOTE: The LuaJIT project owner states that the debug libary is unsafe by definition and that this is not a vulnerability. When LuaJIT was originally developed, the expectation was that the entire debug library had no security guarantees and thus it made no sense to assign CVEs. However, not all users of later LuaJIT derivatives share this perspective

The weakness was shared 11/29/2019. This vulnerability was named CVE-2019-19391. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

The real existence of this vulnerability is still doubted at the moment. The vulnerability scanner Nessus provides a plugin with the ID 255190 (Debian dla-4283 : libluajit-5.1-2 - security update), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (255190). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• LuaJIT

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5

Website

• Product: https://github.com/LuaJIT/LuaJIT/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion