CVE-2020-24371

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-24371
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24371.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-24371
Aliases
Downstream
Related
Published
2020-08-17T17:15:13.927Z
Modified
2026-07-09T00:06:41.786385Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.

References

Affected packages

Git / github.com/lua/lua

Affected ranges

Type
GIT
Repo
https://github.com/lua/lua
Events
Introduced
c33b1728aeb7dfeec4013562660e07d32697aa6b
Last affected
c33b1728aeb7dfeec4013562660e07d32697aa6b
Fixed
a6da1472c0c5e05ff249325f979531ad51533110
Database specific 
{
    "cpe": "cpe:2.3:a:lua:lua:5.4.0:-:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.4.0-NA"
        },
        {
            "last_affected": "5.4.0-NA"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.4.0-NA
v5.*
v5.4.0

Database specific

vanir_signatures_modified 
"2026-07-09T00:06:41Z"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 491.0,
            "function_hash": "230888440196023068660042484403295836192"
        },
        "signature_version": "v1",
        "source": "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
        "id": "CVE-2020-24371-3ad77f13",
        "target": {
            "function": "remarkupvals",
            "file": "lgc.c"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 463.0,
            "function_hash": "148649635605489108398390794752528839496"
        },
        "signature_version": "v1",
        "source": "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
        "id": "CVE-2020-24371-717ce452",
        "target": {
            "function": "atomic2gen",
            "file": "lgc.c"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 438.0,
            "function_hash": "73126039911420152274233437857816255771"
        },
        "signature_version": "v1",
        "source": "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
        "id": "CVE-2020-24371-b816129f",
        "target": {
            "function": "luaC_barrier_",
            "file": "lgc.c"
        }
    },
    {
        "signature_type": "Function",
        "deprecated": false,
        "digest": {
            "length": 820.0,
            "function_hash": "62293687244825559462354794285034139876"
        },
        "signature_version": "v1",
        "source": "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
        "id": "CVE-2020-24371-ed9eccc8",
        "target": {
            "function": "youngcollection",
            "file": "lgc.c"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "247043816592523228306167864313656777148",
                "128022539470724253876190143736616008833",
                "277784156431681346734209104841665649763",
                "293610384820954965735016816188173325444",
                "180122197416099943960443147549862980667",
                "146946380213547060947882303726874734793",
                "117165732476182395299500896645280365288",
                "188730725681045488505131978435297376627",
                "269972676927384416685274953499422962496",
                "218390374446829489799854226723855946150",
                "63801094826520712061319164997725480474",
                "12340125685636578054225060909693252412",
                "263165008466768107267534801681210705820",
                "324223054354298017487335419729354385561",
                "281694410998367628274707905667833317721",
                "90661529539236227515015123442963964233",
                "331768705513796519620639853311959911390",
                "61153750338018608563606415716016360437",
                "316178962228218637641645618391086218149",
                "29169271078618445766426752526479696958",
                "274141475334442822849514259158662979723",
                "315602760525419211381069342473058358726",
                "124356748170853152830734215933560967725",
                "298493242176478445102444444559732226850",
                "42742995477068854504560106584943118884",
                "332334190360064138671157402824931776680",
                "79662100093156639030414633139045847225",
                "42949527436635597150540362450550434437",
                "194541665703311230294064044909546994559",
                "4436196464461007259879259789700659912",
                "62075780827700133745497836683468249733",
                "86267174718487447218983876365871746188",
                "62160341757005522749984961342269236912",
                "182797068030575012903286821449990934710",
                "337715759172909069055848498856358582938",
                "288235394316488958967272638655547118720",
                "34516602568621660371087614665292278998",
                "299813941888886661147148464353338899467"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
        "id": "CVE-2020-24371-f2e531cd",
        "target": {
            "file": "lgc.c"
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24371.json"