Understanding CVE-2021-45985: Risks, Mitigation, and Microsoft's Response

Attention Windows enthusiasts, software developers, and cybersecurity nerds—it's time to dive headfirst into a critical vulnerability that could potentially wreak havoc on your systems if left unchecked. We’re talking about CVE-2021-45985, a vulnerability that arises due to an erroneous finalizer call in Lua, which leads to a heap-based buffer over-read. While this may sound like a highly specialized problem that won't affect most users, let’s break it down step by step, connecting the dots on why this is something you should be paying close attention to.
We'll cover:

• What CVE-2021-45985 means in layman's terms.
• Microsoft’s response and recommendations for mitigation.
• Steps to protect yourself moving forward.
• Broader implications beyond Windows.

So buckle up for a whirlwind geek ride!

---

What is CVE-2021-45985? The Low-Down on Lua's Weak Link​

The vulnerability exists in Lua, a lightweight, high-level scripting language commonly embedded in applications because of its small footprint and flexibility. Popular software frameworks, games, and even IoT devices leverage Lua. But here’s the kicker: when there's a flaw within Lua itself, any application using the affected version potentially inherits the same exposure.

The Technical Details​

This particular vulnerability stems from an erroneous finalizer call in Lua, leading to a heap-based buffer over-read. Now, unless you're knee-deep into programming lingo, these words probably sound cryptic, so let’s simplify:

• Heap-based Buffer Over-read: Think of a program’s memory as a well-organized desk with designated drawers for data. A heap-based buffer over-read means the program is reaching into the wrong drawer, accidentally reading data it shouldn't have access to. This misstep can lead to unintended consequences, such as sensitive data leakage or software crashes.
• Erroneous Finalizer Call: In object-oriented programming (OOP), a "finalizer" is like the cleanup crew—it gets invoked when an object (a chunk of data) is no longer needed, making sure to release memory safely. In this case, Lua's cleanup crew isn't just forgetting to tidy up—it’s throwing the wrong data into the shredder, causing the program to fumble.

The Severity​

Since Lua is widely used, any application embedding a vulnerable version of Lua becomes a prime target. An attacker exploiting this vulnerability could trigger undefined behavior in the program, ranging from application crashes to reading unintended memory locations.

---

Microsoft's Response: Patching Up Windows Like Pros​

Microsoft acts swiftly when these kinds of vulnerabilities come to light, considering that Windows operating systems could serve as a launchpad for such exploits. For CVE-2021-45985, Microsoft has updated its security advisories to include mitigation information for its operating system ecosystem.

Key Actions From Microsoft:​

• Added Windows Software to the Security Updates Table:
• The security update guide has been revised to reflect measures applicable to users of Windows. This means Microsoft officially recommends users update their operating systems to the latest version available. If you're still running a legacy version of Windows (looking at you, Windows 7 die-hards), it’s time to bid farewell and take the upgrade plunge.
• Updated FAQ Section:
• The FAQ outlines specific actions users need to take. The emphasis is on installing relevant updates directly through Windows Update or the Microsoft Update Catalog.
• While Microsoft doesn’t explicitly call out affected Lua versions embedded in third-party applications, users are encouraged to ensure those programs are either updated or patched, if possible.

---

How to Patch & Avoid Falling Prey to CVE-2021-45985​

Here’s the action plan for all Windows users and organizations alike:

1. Update Your Windows OS​

Windows Update is your best friend here. Keeping your system updated ensures essential security patches are applied. This not only covers vulnerabilities like CVE-2021-45985 but protects against a myriad of other threats. Here's how to ensure you're patched:

• For Windows 10/11 Users:
• Open the Start Menu.
• Go to Settings > Update & Security > Windows Update.
• Click Check for updates and install any pending updates.
• For Legacy Systems:
• Legacy Windows users should strongly consider upgrading to supported operating systems. Extended support editions might cover issues like this, but full protection likely rests on moving forward.

2. Verify Lua Embedded Apps Are Patched​

Some applications using Lua might not rely on Windows updates directly. For instance, games or utilities bundled with custom Lua runtimes need individual updates from their respective maintainers. Double-check version compatibility across your software stack.

3. Deploy Mitigation Strategies​

Tech-savvy users or IT administrators can consider additional defenses:

• Monitoring Network Access: Lua scripts that interact heavily with network libraries could become exploitation vectors. Use firewalls to restrict unnecessary outbound/inbound communication.
• Leverage Virtualization: Running untrusted or legacy Lua-based apps in a sandbox or virtual machine reduces exposure to your main OS.

---

Why Should You Care? Broader Implications of Vulnerabilities Like CVE-2021-45985​

Now, you might be wondering, “Isn’t this just another developer problem?” Not really. Here’s why vulnerabilities like this carry weight for average users and organizations alike:

• Cross-Platform Risks:
• Lua isn’t confined to Windows—it runs on macOS, Linux, embedded hardware, and more. If you use software developed with Lua across different devices, it’s essential to understand how this vulnerability impacts the ecosystem holistically.
• Data Breaches Start Small:
• A heap over-read exploit might not seem flashy, but in the hands of a skilled attacker, it could lead to significant data leakage or memory manipulation. Think of it as opening a side door in a seemingly impenetrable castle.
• Ransomware/Escalation Chains:
• Vulnerabilities in Lua could serve as part of a larger chain of exploits. Attackers exploiting memory faults might elevate privileges to deliver more damaging payloads like ransomware.

---

Conclusion: Batten Down the Hatches and Stay Aware​

CVE-2021-45985 stands as a stark reminder of the ever-present need for vigilance against software vulnerabilities. As embedded scripting languages like Lua continue proliferating in industry and consumer applications, these "small" flaws can have surprisingly large implications.
So, whether you're a casual Windows user, a game developer, or a cybersecurity enthusiast, the takeaway is clear:

• Update all the things! This includes your Windows OS, installed applications, and any Lua-based software.
• Stay informed about vulnerabilities and mitigation updates directly from Microsoft (or trusted third-party sources).

Finally, if you have questions or insights, sound off in the comments below. How has CVE-2021-45985 affected your workflow or organization, and what proactive steps are you taking to stay ahead of these vulnerabilities? We’re all ears!

---

Source: MSRC https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-45985