CVE-2019-19391 describes a type confusion vulnerability in LuaJIT through version 2.0.5, affecting products like Moonjit before 2.1.2. This flaw within the debug.getinfo function can lead to arbitrary memory read or write operations due to mishandled stack levels and options. With a CVSS score of 9.1 (CRITICAL), this vulnerability has a network attack vector, low attack complexity, and can result in high confidentiality and integrity impacts. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.0.5CPE matchmatch criteria | cpe:2.3:a:luajit:luajit:*:*:*:*:*:*:*:* | ||
< 2.1.2CPE matchmatch criteria | cpe:2.3:a:moonjit_project:moonjit:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
CVE-2019-19391
Jun 11, 2024In LuaJIT through 2.0.5 as used in Moonjit before 2.1.2 and other products debug.getinfo has a type confusion issue that leads to arbitrary memory write or read operations because certain cases involving valid stack levels and > options are mishandled. NOTE: The LuaJIT project owner states that the debug libary is unsafe by definition and that this is not a vulnerability. When LuaJIT was originally developed the expectation was that the entire debug library had no security guarantees and thus it made no sense to assign CVEs. However not all users of later LuaJIT derivatives share this perspective
Nov 12, 2019