search

Proxmark / proxmark3

Proxmark 3
http://www.proxmark.org/
GNU General Public License v2.0
3.09k stars 901 forks source link

Backport CVE-2020-24370's patch #1021

Closed Crispy-fried-chicken closed 5 months ago

Crispy-fried-chicken commented 5 months ago

CVE-2020-24370 is a security vulnerability in lua. Although the CVE decription in CVE-2020-24370 said that this CVE only affected lua 5.4.0, according to lua this CVE actually existed since lua 5.2. The root cause of this CVE is the negation overflow that occurs when you try to take the negative of 0x80000000. Thus, this CVE also exists in proxmark3. Try to backport the fix to the lua in proxmark3 since the original fix is for 5.4 and several functions have been changed.

hornet-hacker commented 5 months ago

This repo is entirely unused at this point, see the RRG repo instead.

Crispy-fried-chicken commented 5 months ago

This repo is entirely unused at this point, see the RRG repo instead.

Sure! I've seen that there is a same bug in the the RRG repo, so I've already created a PR for it which is https://github.com/RfidResearchGroup/proxmark3/pull/2285 please check it! Thank you!