CVE-2020-24371
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a...
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
- Record
CVE-2020-24371- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-763
- Updated
- 2026-11-02
CVE List No score
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
- Record
CVE-2020-24371- Updated
- 2026-11-02
EUVDEUVD-2020-17103 No score
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
- Record
EUVD-2020-17103- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4m5p-2hm8-9fxm
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a...
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
- Record
GHSA-4m5p-2hm8-9fxm- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-763
- Updated
- 2026-11-02
OSVAZL-40962
CVE-2020-24371 affecting package ceph for versions less than 18.2.2-3
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
- Record
AZL-40962- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-05
OSV
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
- Record
CVE-2020-24371- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Show 8 moreShow less
OSVDEBIAN-CVE-2020-24371
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
- Record
DEBIAN-CVE-2020-24371- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVBIT-lua-2020-24371 No score
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
- Record
BIT-lua-2020-24371- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0962-1 No score
Security update for lua53
This update for lua53 fixes the following issues:
Update to version 5.3.6:
- CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449)
- CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448)
- Long brackets with a huge number of '=' overflow some internal buffer arithmetic.
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:0962-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2196-1 No score
Security update for lua53
This update for lua53 fixes the following issues:
Update to version 5.3.6:
- CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449)
- CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448)
- Long brackets with a huge number of '=' overflow some internal buffer arithmetic.
- Record
openSUSE-SU-2021:2196-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11028-1 No score
liblua5_3-5-32bit-5.3.6-1.6 on GA media
These are all security issues fixed in the liblua5_3-5-32bit-5.3.6-1.6 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11028-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11029-1 No score
liblua5_4-5-32bit-5.4.3-4.2 on GA media
These are all security issues fixed in the liblua5_4-5-32bit-5.4.3-4.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11029-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15401-1 No score
liblua5_5-5-5.5.0~beta1-1.1 on GA media
These are all security issues fixed in the liblua5_5-5-5.5.0~beta1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15401-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2196-1 No score
Security update for lua53
This update for lua53 fixes the following issues:
Update to version 5.3.6:
- CVE-2020-24371: lgc.c mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage (bsc#1175449)
- CVE-2020-24370: ldebug.c allows a negation overflow and segmentation fault in getlocal and setlocal (bsc#1175448)
- Long brackets with a huge number of '=' overflow some internal buffer arithmetic.
- Record
SUSE-SU-2021:2196-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cephAzure Linux:3 |
before 18.2.2-3 | 18.2.2-3 |
luaBitnami |
5.4.0 up to 5.4.1 | 5.4.1 |
lua5.4Debian:12 |
before 5.4.1-1 | 5.4.1-1 |
lua5.4Debian:13 |
before 5.4.1-1 | 5.4.1-1 |
lua5.4Debian:14 |
before 5.4.1-1 | 5.4.1-1 |
lua53SUSE:Linux Enterprise Module for Basesystem 15 SP2 From an advisory covering 2 CVEs |
before 5.3.6-3.6.1 | 5.3.6-3.6.1 |
lua53SUSE:Linux Enterprise Module for Basesystem 15 SP3 From an advisory covering 2 CVEs |
before 5.3.6-3.6.1 | 5.3.6-3.6.1 |
lua53SUSE:Linux Enterprise Micro 5.0 From an advisory covering 2 CVEs |
before 5.3.6-3.6.1 | 5.3.6-3.6.1 |
lua53openSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 5.3.6-lp152.5.3.1 | 5.3.6-lp152.5.3.1 |
lua53openSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 5.3.6-3.6.1 | 5.3.6-3.6.1 |
lua55openSUSE:Tumbleweed From an advisory covering 9 CVEs |
before 5.5.0~beta1-1.1 | 5.5.0~beta1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-24371 is a medium vulnerability (CVSS 5.3) in Lua, published August 17, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.75%, the 77th percentile. Fixed in ceph 18.2.2-3.
References
github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110
lua.org/bugs.html
nvd.nist.gov/vuln/detail/CVE-2020-24371
security-tracker.debian.org/tracker/CVE-2020-24371
suse.com/support/update/announcement/2021/suse-su-20212196-1
Show 13 moreShow less
bugzilla.suse.com/1175448
lists.opensuse.org/archives/list/[email protected]/thread/OOVDNMRFDTKUTT25LOX5ABPHFFAREA4V