Every CVE Search/ Get API key

CVE-2020-24370

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal,...

5.3 MediumPublic exploitFix available

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

3.83%Up 2.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.3

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Record
CVE-2020-24370
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-191
Updated
2026-11-02
CVE List No score

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Record
CVE-2020-24370
Updated
2026-11-02
EUVDEUVD-2020-17102 No score

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Record
EUVD-2020-17102
Updated
2026-11-03
GitHub AdvisoriesGHSA-gfr4-c37g-mm3v 5.3

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal,...

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Record
GHSA-gfr4-c37g-mm3v
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-191
Updated
2026-11-02
OSVAZL-41149 5.3

CVE-2020-24370 affecting package lua for versions less than 5.4.6-1

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Record
AZL-41149
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-05
OSVBELL-CVE-2020-24370 5.3

CVE-2020-24370 does not affect BellSoft software

Record
BELL-CVE-2020-24370
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
Show 20 moreShow less
OSV 5.3

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Record
CVE-2020-24370
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2020-24370 5.3

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Record
DEBIAN-CVE-2020-24370
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVJLSEC-2026-555 5.3

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Record
JLSEC-2026-555
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
OSVOESA-2024-2169 5.3

lua security update

Lua is a powerful, efficient, lightweight, embeddable scripting language. It supports procedural programming, object-oriented programming, functional programming, data-driven programming, and data description.

Security Fix(es):

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)

Record
OESA-2024-2169
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1278 5.3

syslinux security update

The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems (SYSLINUX), network booting (PXELINUX), bootable "El Torito" CD-ROMs (ISOLINUX), and Linux ext2/ext3/ext4 or btrfs filesystems (EXTLINUX). The project also includes MEMDISK, a tool to boot legacy operating systems (such as DOS) from nontraditional media; it is usually used in conjunction with PXELINUX and ISOLINUX.

Security Fix(es):

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)

Record
OESA-2025-1278
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1279 5.3

syslinux security update

The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems (SYSLINUX), network booting (PXELINUX), bootable "El Torito" CD-ROMs (ISOLINUX), and Linux ext2/ext3/ext4 or btrfs filesystems (EXTLINUX). The project also includes MEMDISK, a tool to boot legacy operating systems (such as DOS) from nontraditional media; it is usually used in conjunction with PXELINUX and ISOLINUX.

Security Fix(es):

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)

Record
OESA-2025-1279
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1280 5.3

syslinux security update

The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems (SYSLINUX), network booting (PXELINUX), bootable "El Torito" CD-ROMs (ISOLINUX), and Linux ext2/ext3/ext4 or btrfs filesystems (EXTLINUX). The project also includes MEMDISK, a tool to boot legacy operating systems (such as DOS) from nontraditional media; it is usually used in conjunction with PXELINUX and ISOLINUX.

Security Fix(es):

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)

Record
OESA-2025-1280
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1281 5.3

syslinux security update

The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems (SYSLINUX), network booting (PXELINUX), bootable "El Torito" CD-ROMs (ISOLINUX), and Linux ext2/ext3/ext4 or btrfs filesystems (EXTLINUX). The project also includes MEMDISK, a tool to boot legacy operating systems (such as DOS) from nontraditional media; it is usually used in conjunction with PXELINUX and ISOLINUX.

Security Fix(es):

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)

Record
OESA-2025-1281
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVOESA-2025-1301 5.3

syslinux security update

The Syslinux Project covers lightweight bootloaders for MS-DOS FAT filesystems (SYSLINUX), network booting (PXELINUX), bootable "El Torito" CD-ROMs (ISOLINUX), and Linux ext2/ext3/ext4 or btrfs filesystems (EXTLINUX). The project also includes MEMDISK, a tool to boot legacy operating systems (such as DOS) from nontraditional media; it is usually used in conjunction with PXELINUX and ISOLINUX.

Security Fix(es):

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).(CVE-2020-24370)

Record
OESA-2025-1301
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2021:4510 5.3

Red Hat Security Advisory: lua security update

Record
RHSA-2021:4510
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRLSA-2021:4510 5.3

Low: lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language.

Security Fix(es):

  • lua: segmentation fault in getlocal and setlocal functions in ldebug.c (CVE-2020-24370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.

Record
RLSA-2021:4510
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVALSA-2021:4510 No score

Low: lua security update

The lua packages provide support for Lua, a powerful light-weight programming language designed for extending applications. Lua is also frequently used as a general-purpose, stand-alone language.

Security Fix(es):

  • lua: segmentation fault in getlocal and setlocal functions in ldebug.c (CVE-2020-24370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2021:4510
Updated
2026-11-02
OSVBIT-lua-2020-24370 No score

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31).

Record
BIT-lua-2020-24370
Updated
2026-11-02
OSVMGASA-2020-0362 No score

Updated lua and lua5.3 packages fix security vulnerability

ldebug.c in Lua 5.4.0 allows a negation overflow and segmentation fault in getlocal and setlocal, as demonstrated by getlocal(3,2^31). (CVE-2020-24370)

Record
MGASA-2020-0362
Updated
2026-11-02
OSVopenSUSE-SU-2021:0962-1 No score

Security update for lua53

This update for lua53 fixes the following issues:

Update to version 5.3.6:

  • CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449)
  • CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448)
  • Long brackets with a huge number of '=' overflow some internal buffer arithmetic.

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2021:0962-1
Updated
2026-11-02
OSVopenSUSE-SU-2021:2196-1 No score

Security update for lua53

This update for lua53 fixes the following issues:

Update to version 5.3.6:

  • CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449)
  • CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448)
  • Long brackets with a huge number of '=' overflow some internal buffer arithmetic.
Record
openSUSE-SU-2021:2196-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11028-1 No score

liblua5_3-5-32bit-5.3.6-1.6 on GA media

These are all security issues fixed in the liblua5_3-5-32bit-5.3.6-1.6 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11028-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11029-1 No score

liblua5_4-5-32bit-5.4.3-4.2 on GA media

These are all security issues fixed in the liblua5_4-5-32bit-5.4.3-4.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11029-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15401-1 No score

liblua5_5-5-5.5.0~beta1-1.1 on GA media

These are all security issues fixed in the liblua5_5-5-5.5.0~beta1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15401-1
Updated
2026-11-02
OSVSUSE-SU-2021:2196-1 No score

Security update for lua53

This update for lua53 fixes the following issues:

Update to version 5.3.6:

  • CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449)
  • CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448)
  • Long brackets with a huge number of '=' overflow some internal buffer arithmetic.
Record
SUSE-SU-2021:2196-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
lua
AlmaLinux:8
 before 5.3.4-12.el8
5.3.4-12.el8
lua-devel
AlmaLinux:8
 before 5.3.4-12.el8
5.3.4-12.el8
lua-libs
AlmaLinux:8
 before 5.3.4-12.el8
5.3.4-12.el8
lua
Azure Linux:3
 before 5.4.6-1
5.4.6-1
lua
Bitnami
 5.2.0 up to 5.2.4, 5.3.0 up to 5.3.6, 5.4.0 up to 5.4.1
5.2.45.3.65.4.1
lua5.3
Debian:12
 before 5.3.6-1
5.3.6-1
lua5.3
Debian:13
 before 5.3.6-1
5.3.6-1
lua5.3
Debian:14
 before 5.3.6-1
5.3.6-1
lua5.4
Debian:12
 before 5.4.1-1
5.4.1-1
lua5.4
Debian:13
 before 5.4.1-1
5.4.1-1
Show 33 moreShow less
Affected packages
PackageAffectedFixed
lua5.4
Debian:14
 before 5.4.1-1
5.4.1-1
lua5.3
Debian:9
 before 5.3.3-1+deb9u1, plus listed versions
5.3.3-1
5.3.3-1+deb9u1
lua5.3
Debian:10
From an advisory covering 2 CVEs
 before 5.3.3-1.1+deb10u1, plus listed versions
5.3.3-1.1
5.3.3-1.1+deb10u1
Lua_jll
Julia
 before 5.3.6+0
5.3.6+0
lua
Mageia:7
 before 5.2.4-3.1.mga7
5.2.4-3.1.mga7
lua5.3
Mageia:7
 before 5.3.5-2.1.mga7
5.3.5-2.1.mga7
lua
openEuler:20.03-LTS-SP4
 before 5.3.5-5.oe2003sp4
5.3.5-5.oe2003sp4
syslinux
openEuler:22.03-LTS-SP3
 before 6.04-17.oe2203sp3
6.04-17.oe2203sp3
syslinux
openEuler:22.03-LTS-SP4
 before 6.04-17.oe2203sp4
6.04-17.oe2203sp4
syslinux
openEuler:24.03-LTS
 before 6.04-17.oe2403
6.04-17.oe2403
syslinux
openEuler:24.03-LTS-SP1
 before 6.04-17.oe2403sp1
6.04-17.oe2403sp1
syslinux
openEuler:20.03-LTS-SP4
 before 6.04-15.oe2003sp4
6.04-15.oe2003sp4
lua
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-libs-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-debugsource
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-libs
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-libs-debuginfo
Red Hat:enterprise_linux:8::baseos
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua
Red Hat:enterprise_linux:8::crb
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-devel
Red Hat:enterprise_linux:8::crb
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua-libs-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua
Rocky Linux:8
 before 0:5.3.4-12.el8
0:5.3.4-12.el8
lua53
SUSE:Linux Enterprise Module for Basesystem 15 SP2
From an advisory covering 2 CVEs
 before 5.3.6-3.6.1
5.3.6-3.6.1
lua53
SUSE:Linux Enterprise Module for Basesystem 15 SP3
From an advisory covering 2 CVEs
 before 5.3.6-3.6.1
5.3.6-3.6.1
lua53
SUSE:Linux Enterprise Micro 5.0
From an advisory covering 2 CVEs
 before 5.3.6-3.6.1
5.3.6-3.6.1
lua53
openSUSE:Leap 15.2
From an advisory covering 2 CVEs
 before 5.3.6-lp152.5.3.1
5.3.6-lp152.5.3.1
lua53
openSUSE:Leap 15.3
From an advisory covering 2 CVEs
 before 5.3.6-3.6.1
5.3.6-3.6.1
lua55
openSUSE:Tumbleweed
From an advisory covering 9 CVEs
 before 5.5.0~beta1-1.1
5.5.0~beta1-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubRenukaSelvar/lua_CVE-2020-243702024-11-06
PoC in GitHubRenukaSelvar/lua_CVE-2020-24370_AfterPatch2024-11-06

History

History
RecordedChangedSources
affected
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-24370 is a medium vulnerability (CVSS 5.3) in Lua, published August 17, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.83%, the 90th percentile. Fixed in lua 5.3.4-12.el8.

References

Show 39 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open