Skip to content

Patch luajit for CVE-2024-25177[HIGH] #14436

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: fasttrack/2.0
Choose a base branch
from
+52 −3
Open

Patch luajit for CVE-2024-25177[HIGH] #14436

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7b9ef2b
Patch luajit for CVE-2024-25177[HIGH]
Aug 5, 2025
c5518d8
Merge branch 'fasttrack/2.0' into kgodara/fasttrack/2.0/luajit/CVE-20…
Kanishk-Bansal Aug 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions SPECS/luajit/CVE-2024-25177.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
From 3c4209f69e4f0f3810b9acfde263569ef7c0a197 Mon Sep 17 00:00:00 2001
From: Mike Pall <mike>
Date: Tue, 23 Jan 2024 18:58:52 +0100
Subject: [PATCH] Fix unsinking of IR_FSTORE for NULL metatable.

Reported by pwnhacker0x18. #1147

Upstream reference:
https://github.com/LuaJIT/LuaJIT/commit/85b4fed0b0353dd78c8c875c2f562d522a2b310f
---
src/lj_snap.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/lj_snap.c b/src/lj_snap.c
index 4140fdb..d2c454c 100644
--- a/src/lj_snap.c
+++ b/src/lj_snap.c
@@ -453,6 +453,7 @@ static TRef snap_replay_const(jit_State *J, IRIns *ir)
case IR_KNUM: case IR_KINT64:
return lj_ir_k64(J, (IROp)ir->o, ir_k64(ir)->u64);
case IR_KPTR: return lj_ir_kptr(J, ir_kptr(ir)); /* Continuation. */
+ case IR_KNULL: return lj_ir_knull(J, irt_type(ir->t));
default: lj_assertJ(0, "bad IR constant op %d", ir->o); return TREF_NIL;
}
}
@@ -882,9 +883,13 @@ static void snap_unsink(jit_State *J, GCtrace *T, ExitState *ex,
if (irk->o == IR_FREF) {
lj_assertJ(irk->op2 == IRFL_TAB_META,
"sunk store with bad field %d", irk->op2);
- snap_restoreval(J, T, ex, snapno, rfilt, irs->op2, &tmp);
- /* NOBARRIER: The table is new (marked white). */
- setgcref(t->metatable, obj2gco(tabV(&tmp)));
+ if (T->ir[irs->op2].o == IR_KNULL) {
+ setgcrefnull(t->metatable);
+ } else {
+ snap_restoreval(J, T, ex, snapno, rfilt, irs->op2, &tmp);
+ /* NOBARRIER: The table is new (marked white). */
+ setgcref(t->metatable, obj2gco(tabV(&tmp)));
+ }
} else {
irk = &T->ir[irk->op2];
if (irk->o == IR_KSLOT) irk = &T->ir[irk->op1];
--
2.45.4

10 changes: 7 additions & 3 deletions SPECS/luajit/luajit.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ Name: luajit
Version: 2.1.0
%global apiver %(v=%{version}; echo ${v%.${v#[0-9].[0-9].}})
%global srcver %{version}%{?rctag:-%{rctag}}
Release: 27%{?dist}
Release: 28%{?dist}
License: MIT
Vendor: Microsoft Corporation
Distribution: Mariner
Expand All @@ -15,12 +15,13 @@ Source0: https://luajit.org/download/LuaJIT-%{srcver}.tar.gz
# Patches from https://github.com/LuaJit/LuaJIT.git
# Generated from v2.1 branch against the 2.1.0-beta3 tag using
# git diff v2.1.0-beta3..v2.1 > luajit-2.1-update.patch
Patch0: luajit-2.1-update.patch
Patch0: luajit-2.1-update.patch
# Patches from https://github.com/cryptomilk/LuaJIT/commits/v2.1-fedora
# git format-patch --stdout -l1 --no-renames v2.1..v2.1-fedora > luajit-2.1-fedora.patch
Patch1: luajit-2.1-fedora.patch
Patch1: luajit-2.1-fedora.patch
Patch2: CVE-2024-25178.patch
Patch3: CVE-2024-25176.patch
Patch4: CVE-2024-25177.patch

BuildRequires: gcc
BuildRequires: make
Expand Down Expand Up @@ -96,6 +97,9 @@ make check || true
%{_libdir}/pkgconfig/%{name}.pc

%changelog
* Tue Aug 05 2025 Kshitiz Godara <[email protected]> - 2.1.0-28
- Patch for CVE-2024-25177

* Thu Jul 17 2025 Azure Linux Security Servicing Account <[email protected]> - 2.1.0-27
- Patch for CVE-2024-25178, CVE-2024-25176

Expand Down
Loading