CVE-2020-24371

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-24371
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24371.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-24371
Aliases
Downstream
AZL (1)
DEBIAN (1)
openSUSE (5)
SUSE (1)
Related
openSUSE (5)
SUSE (1)
Published
2020-08-17T17:15:13Z
Modified
2026-07-09T00:06:41Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.

References

Affected packages

Git / github.com/lua/lua

Affected ranges

Type
GIT
Repo
https://github.com/lua/lua
Events
Introduced
c33b1728aeb7dfeec4013562660e07d32697aa6b
Last Affected
c33b1728aeb7dfeec4013562660e07d32697aa6b
Fixed
a6da1472c0c5e05ff249325f979531ad51533110
Database specific
Show details 
{
    "cpe":  "cpe:2.3:a:lua:lua:5.4.0:-:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "5.4.0-NA"
        },
        {
            "last_affected":  "5.4.0-NA"
        }
    ],
    "source":  [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.4.0-NA
v5.*
v5.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24371.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "230888440196023068660042484403295836192",
            "length":  491
        },
        "id":  "CVE-2020-24371-3ad77f13",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
        "target":  {
            "file":  "lgc.c",
            "function":  "remarkupvals"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "148649635605489108398390794752528839496",
            "length":  463
        },
        "id":  "CVE-2020-24371-717ce452",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
        "target":  {
            "file":  "lgc.c",
            "function":  "atomic2gen"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "73126039911420152274233437857816255771",
            "length":  438
        },
        "id":  "CVE-2020-24371-b816129f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
        "target":  {
            "file":  "lgc.c",
            "function":  "luaC_barrier_"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "62293687244825559462354794285034139876",
            "length":  820
        },
        "id":  "CVE-2020-24371-ed9eccc8",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
        "target":  {
            "file":  "lgc.c",
            "function":  "youngcollection"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "247043816592523228306167864313656777148",
                "128022539470724253876190143736616008833",
                "277784156431681346734209104841665649763",
                "293610384820954965735016816188173325444",
                "180122197416099943960443147549862980667",
                "146946380213547060947882303726874734793",
                "117165732476182395299500896645280365288",
                "188730725681045488505131978435297376627",
                "269972676927384416685274953499422962496",
                "218390374446829489799854226723855946150",
                "63801094826520712061319164997725480474",
                "12340125685636578054225060909693252412",
                "263165008466768107267534801681210705820",
                "324223054354298017487335419729354385561",
                "281694410998367628274707905667833317721",
                "90661529539236227515015123442963964233",
                "331768705513796519620639853311959911390",
                "61153750338018608563606415716016360437",
                "316178962228218637641645618391086218149",
                "29169271078618445766426752526479696958",
                "274141475334442822849514259158662979723",
                "315602760525419211381069342473058358726",
                "124356748170853152830734215933560967725",
                "298493242176478445102444444559732226850",
                "42742995477068854504560106584943118884",
                "332334190360064138671157402824931776680",
                "79662100093156639030414633139045847225",
                "42949527436635597150540362450550434437",
                "194541665703311230294064044909546994559",
                "4436196464461007259879259789700659912",
                "62075780827700133745497836683468249733",
                "86267174718487447218983876365871746188",
                "62160341757005522749984961342269236912",
                "182797068030575012903286821449990934710",
                "337715759172909069055848498856358582938",
                "288235394316488958967272638655547118720",
                "34516602568621660371087614665292278998",
                "299813941888886661147148464353338899467"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2020-24371-f2e531cd",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
        "target":  {
            "file":  "lgc.c"
        }
    }
]
vanir_signatures_modified 
"2026-07-09T00:06:41Z"