[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ZtNAbQhxqsQy3rgH@256bit.org>
Date: Sat, 31 Aug 2024 18:10:21 +0200
From: Christian Brabandt <cb@...bit.org>
To: oss-security@...ts.openwall.com
Subject: [vim-security] heap-buffer-overflow in Vim > 9.1.0038 && < 9.1.0707
heap-buffer-overflow in Vim > 9.1.0038 and Vim < 9.1.0707
=========================================================
Date: 31.08.2024
Severity: Low
CVE: <not-yet-assigned>
CWE: Heap-based buffer overlow (CWE-122)
Patch v9.1.0038 optimized how the cursor position is calculated and
removed a loop, that verified that the cursor position always points
inside a line and does not become invalid by pointing beyond the end of
a line. Back then we assumed this loop is unnecessary.
However, this change made it possible that the cursor position stays
invalid and points beyond the end of a line, which would eventually
cause a heap-buffer-overflow when trying to access the line pointer at
the specified cursor position.
It's not quite clear yet, what can lead to this situation that the
cursor points to an invalid position. That's why patch v9.1.0707 does
not include a test case.
Impact is low since we have only seen a crash when feeding some fuzzy
generated files at Vim and not during a real editing session. However
this may lead to a crash.
The Vim project would like to thank github user SuyueGuo for reporting
this issue.
The issue has been fixed as of Vim patch v9.1.0707
References:
https://github.com/vim/vim/commit/396fd1ec2956307755392a1
https://github.com/vim/vim/security/advisories/GHSA-wxf9-c5gx-qrwr
Thanks,
Chris
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
