Description
singlevar in lparser.c in Lua from (including) 5.4.0 up to (excluding) 5.4.4 lacks a certain luaK_exp2anyregup call, leading to a heap-based buffer over-read that might affect a system that compiles untrusted Lua code.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lua5.4 | 5.4.4-2 | — |
| Debian 13 | lua5.4 | 5.4.4-2 | — |
| Debian 12 | lua5.4 | 5.4.4-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | lua5.4 | 5.4.4-1ubuntu0.1~esm1 | USN-6916-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | lua +2 | 5.4.4-3.el9 | RHSA-2023:2582 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | lua +2 | 5.4.4-3.el9 | ALSA-2023:2582 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | lua5.4 | 5.4.4-r4 | — |
| Alpine v3.23 | lua5.4 | 5.4.4-r4 | — |
| Alpine v3.22 | lua5.4 | 5.4.4-r4 | — |
| Alpine v3.21 | lua5.4 | 5.4.4-r4 | — |
| Alpine v3.20 | lua5.4 | 5.4.4-r4 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | lua5.4 | 5.4.4-r4 | — |
| Alpine v3.18 | lua5.4 | 5.4.4-r4 | — |
| Alpine v3.17 | lua5.4 | 5.4.4-r4 | — |
| Alpine v3.16 | lua5.4 | 5.4.4-r4 | — |
| Alpine v3.15 | lua5.4 | 5.4.3-r1 | — |
| Alpine v3.14 | lua5.4 | 5.4.3-r1 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ntopng | 5.2.1-3 | — |
| Azure Linux 2 (CBL-Mariner) | lua | 5.4.3-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | lua +2 | 5.4.4-3.el9 | ELSA-2023-2582 |
Advisories 8
- ALSA-2023:2582 Low: lua security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2023-2031 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- RHSA-2023:2582 Red Hat Security Advisory: lua security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2023-1185 Red Hat Enterprise Linux: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 3, 2026
- USN-6916-1 lua5.4 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- SCA-2025-0006 Vulnerability affecting picoScan and multiScan SICK PSIRT · Apr 28, 2025
- ELSA-2023-2582 Low: lua security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 15, 2023
References
- https://lua-users.org/lists/lua-l/2022-02/msg00001.html
- https://lua-users.org/lists/lua-l/2022-02/msg00070.html
- https://lua-users.org/lists/lua-l/2022-04/msg00009.html
- https://github.com/lua/lua/commit/1f3c6f4534c6411313361697d98d1145a1f030fa
- FEDORA-2022-b9ed35a7ad vendor-advisory
- FEDORA-2022-5b5889f43a vendor-advisory
- GLSA-202305-23 vendor-advisory