]> git.proxmox.com Git - mirror_zfs.git/commit
LUA: Backport CVE-2020-24370's patch
authorthe-Chain-Warden-thresh <18302010006@fudan.edu.cn>
Wed, 7 Feb 2024 19:53:05 +0000 (03:53 +0800)
committerGitHub <noreply@github.com>
Wed, 7 Feb 2024 19:53:05 +0000 (11:53 -0800)
commit229b9f4ed05e6d14fb4d73fa04a71e99b01bb534
tree4454d266260da2745a41cba368812cf3adbe0e67
parent0823388752770b85be0890c8482b314b501e79ec
LUA: Backport CVE-2020-24370's patch

CVE-2020-24370 is a security vulnerability in lua. Although the CVE
description in CVE-2020-24370 said that this CVE only affected lua
5.4.0, according to lua this CVE actually existed since lua 5.2. The
root cause of this CVE is the negation overflow that occurs when you
try to take the negative of 0x80000000. Thus, this CVE also exists in
openzfs. Try to backport the fix to the lua in openzfs since the
original fix is for 5.4 and several functions have been changed.

https://github.com/advisories/GHSA-gfr4-c37g-mm3v
https://nvd.nist.gov/vuln/detail/CVE-2020-24370
https://www.lua.org/bugs.html#5.4.0-11
https://github.com/lua/lua/commit/a585eae6e7ada1ca9271607a4f48dfb1786

Reviewed-by: Tony Hutter <hutter2@llnl.gov>
Reviewed-by: Brian Behlendorf <behlendorf1@llnl.gov>
Signed-off-by: ChenHao Lu <18302010006@fudan.edu.cn>
Closes #15847
module/lua/ldebug.c