CVE-2024-25176: LuaJIT Buffer Overflow Vulnerability

CVE-2024-25176 Overview

CVE-2024-25176 is a stack-buffer-overflow vulnerability affecting LuaJIT through version 2.1 and OpenResty luajit2 before v2.1-20240626. The flaw resides in the lj_strfmt_wfnum function inside lj_strfmt_num.c, which handles numeric string formatting. An attacker who can supply crafted Lua input to a vulnerable application can corrupt the stack and influence program execution. The issue is classified under [CWE-121] Stack-based Buffer Overflow.

Critical Impact
Network-reachable applications embedding LuaJIT, including OpenResty/NGINX deployments, can be compromised through crafted numeric formatting input, leading to memory corruption and potential code execution.

Affected Products

LuaJIT through version 2.1
OpenResty luajit2 before v2.1-20240626
Downstream distributions packaging LuaJIT (including Debian LTS)

Discovery Timeline

2025-07-07 - CVE-2024-25176 published to NVD
2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-25176

Vulnerability Analysis

The vulnerability exists in lj_strfmt_wfnum, a routine in lj_strfmt_num.c responsible for writing formatted numeric values into a string buffer. The function operates on a fixed-size stack buffer to assemble the textual representation of floating-point numbers. When specific format width and precision combinations are processed, the routine writes beyond the bounds of that stack-allocated buffer.

Because LuaJIT is embedded in many network-facing applications, attacker-controlled format strings or numeric parameters can reach this code path through scripting interfaces. Successful exploitation corrupts adjacent stack frames, return addresses, and saved registers, enabling control-flow hijacking on platforms without effective stack protections.

Root Cause

The root cause is missing bounds enforcement in the numeric formatting writer. The function assumes that the maximum output size fits within the local buffer, but supplying large width or precision specifiers produces output that exceeds that assumption. The upstream fix in commit 343ce0edaf3906a62022936175b2f5410024cbfc rewrites the buffer handling so the size constraints match the maximum possible formatted output.

Attack Vector

Exploitation requires the attacker to provide Lua input that reaches string.format or equivalent numeric formatting paths. In OpenResty and NGINX-LuaJIT deployments, this can occur through HTTP request parameters that drive Lua-side formatting logic. No authentication is needed when the vulnerable code path is exposed through a web endpoint. A public proof-of-concept is referenced in the GitHub Issue Discussion and a Gist PoC.

Detection Methods for CVE-2024-25176

Indicators of Compromise

Unexpected crashes or segmentation faults in luajit or nginx worker processes referencing lj_strfmt_wfnum in stack traces.
Core dumps generated by OpenResty workers shortly after processing crafted HTTP requests.
Anomalous restarts of LuaJIT-embedded services without corresponding configuration changes.

Detection Strategies

Inventory all systems running LuaJIT or OpenResty and compare installed versions against the fixed release v2.1-20240626 or later.
Inspect Lua source for use of string.format with attacker-controlled width or precision specifiers on numeric inputs.
Run fuzz testing against exposed endpoints that pass user data into Lua numeric formatting routines.

Monitoring Recommendations

Forward NGINX/OpenResty worker crash logs and dmesg segfault entries to a centralized log platform for correlation.
Alert on repeated worker process restarts that include lj_strfmt symbols in backtraces.
Monitor HTTP request payloads for unusually long numeric format strings targeting Lua-driven endpoints.

How to Mitigate CVE-2024-25176

Immediate Actions Required

Upgrade LuaJIT to a build containing commit 343ce0edaf3906a62022936175b2f5410024cbfc or later.
Upgrade OpenResty luajit2 to v2.1-20240626 or newer and rebuild dependent NGINX modules.
Apply the Debian LTS security update referenced in the Debian LTS Announcement.
Audit Lua scripts that accept untrusted input into string.format and restrict width/precision specifiers.

Patch Information

The upstream fix is published in the LuaJIT GitHub Commit and mirrored in the OpenResty Commit Update. The patch corrects buffer sizing in lj_strfmt_wfnum so formatted numeric output cannot exceed the destination buffer. Distribution maintainers including Debian have shipped backported updates.

Workarounds

Validate and constrain numeric format specifiers in Lua application code, rejecting requests with excessive width or precision.
Place a web application firewall in front of OpenResty endpoints to filter requests containing oversized format-like parameters.
Restrict execution of untrusted Lua bytecode and disable script ingestion paths that are not strictly required.

bash

# Configuration example: verify patched LuaJIT version
luajit -v
# Expected output should reference a build dated 2024-06-26 or later

# Debian/Ubuntu systems
apt-get update && apt-get install --only-upgrade luajit libluajit-5.1-2

# OpenResty rebuild against patched luajit2
cd /path/to/openresty-source
./configure --with-luajit && make && make install