CVE-2021-45985

A heap-based buffer overflow issue was found in Lua Interpreter. The vulnerability can be exploited when an erroneous finalizer calls during a tail call with an invalid stack, triggering an out-of-bounds read, leading to a crash or a denial of service.

The bug exists in Lua Interpreter since v5.4.3 and fixed in v5.4.4.

RHEL-6, 7, 8 ships Lua-v5.3.4 and prior versions, which does not contains the vulnerable function. And RHEL-9 already ships Lua-v5.4.4 and above, which contains the fix. Hence, none of the Lua versions shipped with Red Hat Enterprise Linux are affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.