Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

A small history of LuaJIT sandbox escapes:

- 5.2, 2016: https://apocrypha.numin.it/talks/lua_bytecode_exploitation.p... (9MB PDF)

- 5.2, 2016: https://github.com/erezto/lua-sandbox-escape

- 5.1, 2015: https://www.corsix.org/content/malicious-luajit-bytecode (warning: dense)

There's a "luarop" link (boop.i0i0.me/blog.lua/luarop) referenced in the PDF, but the link sadly seems to have died (IA never crawled the domain).



The first two of those seem to be for regular Lua, not LuaJIT.

Do any of them work without needing to load arbitrary bytecode, which is known to be insecure?


Oh duh, facepalm. The significance of that tidbit was completely lost on my remembering...

And presumably not.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: