cve/2019/CVE-2019-6706.md

CVE-2019-6706

Description

Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example, a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.

POC

Reference

• http://packetstormsecurity.com/files/151335/Lua-5.3.5-Use-After-Free.html
• https://www.exploit-db.com/exploits/46246/

Github

• https://github.com/ARPSyndicate/cvemon