Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-45985
HistoryApr 10, 2023 - 12:00 a.m.

CVE-2021-45985

2023-04-1000:00:00
ubuntu.com
ubuntu.com
10
lua 5.4.3
erroneous finalizer
heap-based buffer
over-read
vulnerability
memcached
vendored lua
vulnerable function

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

49.8%

In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a
heap-based buffer over-read.

Bugs

Notes

Author Note
mdeslaur memcached not built with experimental proxy code, so vendored lua isn’t built
ccdm94 vulnerable function introduced by commit 14c3aa12b

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

49.8%