Lua through 5.4.0 allows a stack redzone cross in luaOpushvfstring because a protection mechanism wrongly calls luaDcallnoyield twice in a row.
{ "vanir_signatures": [ { "id": "CVE-2020-24342-46e61d2d", "signature_type": "Function", "digest": { "function_hash": "19393622418567517198781995424538435971", "length": 203.0 }, "target": { "file": "ldo.c", "function": "luaD_callnoyield" }, "source": "https://github.com/lua/lua/commit/34affe7a63fc5d842580a9f23616d057e17dfe27", "signature_version": "v1", "deprecated": false }, { "id": "CVE-2020-24342-e3b3e09e", "signature_type": "Line", "digest": { "line_hashes": [ "307434724169721203115088959011068448315", "142710705972916715821753310510346050538", "132059686558750829782112284199427550874", "289888402931218646482748640243965616128", "244127718289203141723121943598927242891", "17269890457240028859642241902384334321", "54095854288253291227407020601160490895" ], "threshold": 0.9 }, "target": { "file": "ldo.c" }, "source": "https://github.com/lua/lua/commit/34affe7a63fc5d842580a9f23616d057e17dfe27", "signature_version": "v1", "deprecated": false } ] }