[Security] CVE-2025-49844: Use-after-free in Lua parser (luaY_parser)

[jinchengyang98]

Summary[/+]

[+]Kvrocks uses a Lua library (RocksLabs/lua) that contains a critical use-after-free vulnerability (CVE-2025-49844), originally from Redis. The luaY_parser() function does not protect the TString created by luaS_new() on the Lua stack, allowing GC to free it during parsing. This can be exploited for remote code execution.[/+]
[+]Discovered at Pwn2Own Berlin 2025 by Wiz.[/+]
[+]## Details[/+]
[+]- CVE: CVE-2025-49844[/+]
[+]- Vulnerable Code: src/lparser.c in RocksLabs/lua[/+]
[+]- Impact: Remote Code Execution (authenticated)[/+]
[+]- Note: Affects PUC Lua fallback path (-DENABLE_LUAJIT=OFF). Default LuaJIT path is not affected.[/+]
[+]## Fix[/+]
[+]In luaY_parser(), anchor the TString to the Lua stack:[/+]
[+]c[/+] [+]TString *tname = luaS_new(L, name);[/+] [+]setsvalue2s(L, L->top, tname);[/+] [+]incr_top(L);[/+] [+]luaX_setinput(L, &lexstate, z, tname);[/+] [+][/+]
[+]And add --L->top; after close_func().[/+]
[+]Upstream Redis fix: redis/redis@d5728cb

[jinchengyang98]

Thank you for the quick fix.

Since CVE-2025-49844 is a critical use-after-free vulnerability that can lead to remote code execution (discovered at Pwn2Own Berlin 2025), would you consider creating a GitHub Security Advisory and requesting a CVE ID for Kvrocks specifically?

Steps: Security tab → Advisories → New draft advisory → fill details → Request CVE ID → publish.

Note: The default LuaJIT build path is not affected, but the PUC Lua fallback path (-DENABLE_LUAJIT=OFF) contains the vulnerable luaY_parser() code from RocksLabs/lua.

This would help the broader ecosystem track this vulnerability in Kvrocks independently from Redis.