CVE-2022-35978: Insufficient Information (NVD-CWE-noinfo)
value: Minetest is a free open-source voxel game engine with easy modding and game creation. In **single player**, a mod can set a global setting that controls the Lua script loaded to display the main menu. The script is then loaded as soon as the game session is exited. The Lua environment the menu runs in is not sandboxed and can directly interfere with the user's system. There are currently no known workarounds.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 10
Published: 2022-08-15T19:15Z
Repository: https://github.com/minetest/minetest
Language: C++
Files changed: src/script/lua_api/l_settings.cpp
Commit date: 2022-05-29 14:00:19 +0200
Commit message: Protect a few more settings from being set from mods

Of those settings main_menu_script has concrete security impact, the rest are added out of abundance of caution.

Diff: diff --git a/src/script/lua_api/l_settings.cpp b/src/script/lua_api/l_settings.cpp
index 14398dda2..3f3fda56e 100644
--- a/src/script/lua_api/l_settings.cpp
+++ b/src/script/lua_api/l_settings.cpp
@@ -25,13 +25,15 @@ with this program; if not, write to the Free Software Foundation, Inc.,
 #include "settings.h"
 #include "noise.h"
 #include "log.h"
 
 
-/* This protects:
- * 'secure.*' settings from being set
- * some mapgen settings from being set
+/* This protects the following from being set:
+ * 'secure.*' settings
+ * some security-relevant settings
+ *   (better solution pending)
+ * some mapgen settings
  *   (not security-criticial, just to avoid messing up user configs)
  */
 #define CHECK_SETTING_SECURITY(L, name) \
 	if (o->m_settings == g_settings) { \
 		if (checkSettingSecurity(L, name) == -1) \
@@ -39,11 +41,11 @@ with this program; if not, write to the Free Software Foundation, Inc.,
 	}
 
 static inline int checkSettingSecurity(lua_State* L, const std::string &name)
 {
 	if (ScriptApiSecurity::isSecure(L) && name.compare(0, 7, "secure.") == 0)
-		throw LuaError("Attempt to set secure setting.");
+		throw LuaError("Attempted to set secure setting.");
 
 	bool is_mainmenu = false;
 #ifndef SERVER
 	is_mainmenu = ModApiBase::getGuiEngine(L) != nullptr;
 #endif
@@ -52,10 +54,21 @@ static inline int checkSettingSecurity(lua_State* L, const std::string &name)
 			"minetest.set_mapgen_setting() should be used instead." << std::endl;
 		infostream << script_get_backtrace(L) << std::endl;
 		return -1;
 	}
 
+	const char *disallowed[] = {
+		"main_menu_script", "shader_path", "texture_path", "screenshot_path",
+		"serverlist_file", "serverlist_url", "map-dir", "contentdb_url",
+	};
+	if (!is_mainmenu) {
+		for (const char *name2 : disallowed) {
+			if (name == name2)
+				throw LuaError("Attempted to set disallowed setting.");
+		}
+	}
+
 	return 0;
 }
 
 LuaSettings::LuaSettings(Settings *settings, const std::string &filename) :
 	m_settings(settings),

Vulnerable code: /* This protects:
 * 'secure.*' settings from being set
 * some mapgen settings from being set
		throw LuaError("Attempt to set secure setting.");
Fixed code: /* This protects the following from being set:
 * 'secure.*' settings
 * some security-relevant settings
 *   (better solution pending)
 * some mapgen settings
		throw LuaError("Attempted to set secure setting.");
	const char *disallowed[] = {
		"main_menu_script", "shader_path", "texture_path", "screenshot_path",
		"serverlist_file", "serverlist_url", "map-dir", "contentdb_url",
	};
	if (!is_mainmenu) {
		for (const char *name2 : disallowed) {
			if (name == name2)
				throw LuaError("Attempted to set disallowed setting.");
		}
	}