LuaJIT Denial-of-Service Vulnerability Due to Unsinking of IR_FSTORE for NULL Metatable

A denial-of-service vulnerability has been identified in LuaJIT versions through 2.1. The issue arises from an unsinking of IR_FSTORE when a NULL metatable is encountered, leading to a segmentation fault. This vulnerability can be exploited by causing the LuaJIT garbage collector to traverse a table with a NULL metatable, which triggers the unsinking behavior and results in a crash.

Impact

Exploitation of this vulnerability causes a segmentation fault, leading to a crash of the LuaJIT process.

Reproduction

The vulnerability can be reproduced by creating a table with a NULL metatable and then triggering a garbage collection step. This can be done by using the AddressSanitizer tool, which will report the segmentation fault caused by the invalid memory access.

Remediation

Users can upgrade to the latest version of LuaJIT, where this vulnerability has been fixed.