🟠 High  |  Source: Microsoft Security Response Center


CVE-2019-6706 is a use-after-free vulnerability in Lua 5.3.5, specifically within the lua_upvaluejoin function in lapi.c. An attacker who can trigger a debug.upvaluejoin call with specially crafted arguments may cause a crash or potentially achieve code execution. Microsoft has published this advisory in relation to Azure, indicating Lua is a dependency within an affected Azure component.

Security Architect’s Take: Identify any Azure services or workloads in your environment that embed Lua 5.3.5 and ensure they are patched to a remediated version. Pay particular attention to services that expose Lua scripting interfaces to untrusted users, such as Redis instances or custom runtimes, as these present the highest exploitation risk.

Original advisory: CVE-2019-6706 Lua 5.3.5 has a use-after-free in lua_upvaluejoin in lapi.c. For example a crash outcome might be achieved by an attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships.