Medium
Security advisory
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-24371
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:36 UTC · Revision 1
Source evidence
lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.
osv:CVE-2020-24371
Complete source record
{
"id": "7681033cd2c0b857753dfe15733d02531a1d1df6efc0067ad582898df857cf54",
"url": "https://osv.dev/vulnerability/CVE-2020-24371",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-24371",
"summary": "lgc.c in Lua 5.4.0 mishandles the interaction between barriers and the sweep phase, leading to a memory access violation involving collectgarbage.",
"evidence": "osv:CVE-2020-24371",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-24371",
"aliases": [
"BIT-lua-2020-24371",
"CVE-2020-24371"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/lua/lua",
"type": "GIT",
"events": [
{
"introduced": "c33b1728aeb7dfeec4013562660e07d32697aa6b"
},
{
"last_affected": "c33b1728aeb7dfeec4013562660e07d32697aa6b"
},
{
"fixed": "a6da1472c0c5e05ff249325f979531ad51533110"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:lua:lua:5.4.0:-:*:*:*:*:*:*",
"range": [
{
"introduced": "5.4.0-NA"
},
{
"last_affected": "5.4.0-NA"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "a6da1472c0c5e05ff249325f979531ad51533110"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"5.4.0-NA",
"v5.4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24371.json",
"vanir_signatures": [
{
"id": "CVE-2020-24371-3ad77f13",
"digest": {
"length": 491,
"function_hash": "230888440196023068660042484403295836192"
},
"source": "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
"target": {
"file": "lgc.c",
"function": "remarkupvals"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24371-717ce452",
"digest": {
"length": 463,
"function_hash": "148649635605489108398390794752528839496"
},
"source": "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
"target": {
"file": "lgc.c",
"function": "atomic2gen"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24371-b816129f",
"digest": {
"length": 438,
"function_hash": "73126039911420152274233437857816255771"
},
"source": "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
"target": {
"file": "lgc.c",
"function": "luaC_barrier_"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24371-ed9eccc8",
"digest": {
"length": 820,
"function_hash": "62293687244825559462354794285034139876"
},
"source": "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
"target": {
"file": "lgc.c",
"function": "youngcollection"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24371-f2e531cd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"247043816592523228306167864313656777148",
"128022539470724253876190143736616008833",
"277784156431681346734209104841665649763",
"293610384820954965735016816188173325444",
"180122197416099943960443147549862980667",
"146946380213547060947882303726874734793",
"117165732476182395299500896645280365288",
"188730725681045488505131978435297376627",
"269972676927384416685274953499422962496",
"218390374446829489799854226723855946150",
"63801094826520712061319164997725480474",
"12340125685636578054225060909693252412",
"263165008466768107267534801681210705820",
"324223054354298017487335419729354385561",
"281694410998367628274707905667833317721",
"90661529539236227515015123442963964233",
"331768705513796519620639853311959911390",
"61153750338018608563606415716016360437",
"316178962228218637641645618391086218149",
"29169271078618445766426752526479696958",
"274141475334442822849514259158662979723",
"315602760525419211381069342473058358726",
"124356748170853152830734215933560967725",
"298493242176478445102444444559732226850",
"42742995477068854504560106584943118884",
"332334190360064138671157402824931776680",
"79662100093156639030414633139045847225",
"42949527436635597150540362450550434437",
"194541665703311230294064044909546994559",
"4436196464461007259879259789700659912",
"62075780827700133745497836683468249733",
"86267174718487447218983876365871746188",
"62160341757005522749984961342269236912",
"182797068030575012903286821449990934710",
"337715759172909069055848498856358582938",
"288235394316488958967272638655547118720",
"34516602568621660371087614665292278998",
"299813941888886661147148464353338899467"
]
},
"source": "https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
"target": {
"file": "lgc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:56:56Z"
}
}
],
"modified": "2026-10-20T13:56:56.703560583Z",
"provider": "osv",
"references": [
"https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110",
"https://www.lua.org/bugs.html#5.4.0-10"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-24371",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388439,
"published_at": "2020-08-17T17:15:13.927+00:00"
}