[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <9ce624fb-1a7c-4ccb-8816-7aadbb754e50@gentoo.org>
Date: Mon, 20 Jan 2025 18:47:27 -0500
From: Eli Schwartz <eschwartz@...too.org>
To: oss-security@...ts.openwall.com, Christian Brabandt <cb@...bit.org>
Subject: Re: Subject: [vim-security] segmentation fault in
win_line() in Vim < 9.1.1043
On 1/20/25 5:04 PM, Christian Brabandt wrote:
> segmentation fault in win_line() in Vim < 9.1.1043
> ==================================================
> Date: 20.01.2025
> Severity: Medium
> CVE: CVE-2025-24014
> CWE: Out-of-bounds Write (CWE-787)
>
> In silent Ex mode (-s -e), Vim typically doesn't show a screen and just
> operates silently in batch mode. However, it is still possible to
> trigger the function that handles the scrolling of a gui version of Vim
> by feeding some binary characters to Vim. The function that handles the
> scrolling however may be triggering a redraw, which will access the
> ScreenLines pointer, even so this variable hasn't been allocated
> (since there is no screen).
>
> In Patch 9.1.1043 Vim will therefore skip the redraw attempt, by testing
> whether the ScreenLines pointer is NULL.
>
> Impact is medium since the user must intentionally and explicitly feed
> some binary data to Vim in ex mode.
>
> The Vim project would like to thank github user @fizz-is-on-the-way
> for reporting this issue.
>
> The issue has been fixed as of Vim patch v9.1.1003
>
> References:
> https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919
> https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955
It seems strange to me to say that it is a vulnerability, for a vim
option that accepts a full-blown script to also crash when fuzzed.
It's not an attack vector to crash /bin/bash when fed a malformed
script, so why is there anything to comment on with regard to vim either?
How is this "medium" impact?
--
Eli Schwartz
Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
