https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3903
CONFIRM:https://huntr.dev/bounties/9c2b2c82-48bb-4be9-ab8f-a48ea252d1b0 URL:https://huntr.dev/bounties/9c2b2c82-48bb-4be9-ab8f-a48ea252d1b0 FEDORA:FEDORA-2021-58ab85548d URL:https://lists.fedoraproject.org/archives/list/[email protected]/message/PGW56Z6IN4UVM3E5RXXF4G7LGGTRBI5C/ FEDORA:FEDORA-2021-b0ac29efb1 URL:https://lists.fedoraproject.org/archives/list/[email protected]/message/FNXY7T5OORA7UJIMGSJBGHFMU6UZWS6P/ FEDORA:FEDORA-2021-cfadac570a URL:https://lists.fedoraproject.org/archives/list/[email protected]/message/BCQWPEY2AEYBELCMJYHYWYCD3PZVD2H7/ GENTOO:GLSA-202208-32 URL:https://security.gentoo.org/glsa/202208-32 MISC:https://github.com/vim/vim/commit/0b5b06cb4777d1401fdf83e7d48d287662236e7e URL:https://github.com/vim/vim/commit/0b5b06cb4777d1401fdf83e7d48d287662236e7e MLIST:[debian-lts-announce] 20220311 [SECURITY] [DLA 2947-1] vim security update URL:https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html MLIST:[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update URL:https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html MLIST:[oss-security] 20220114 Re: 3 new CVE's in vim URL:http://www.openwall.com/lists/oss-security/2022/01/15/1
Heap-based Buffer Overflow in vim/vim Valid Reported on Oct 26th 2021
Greetings,
A Heap-based Buffer Overflow issue was discovered in Vim.
The POC file is reduced to the absolute minimum to reproduce the problem. Please see sanitizer output and the "trimmed" POC file link below.
System info OS version : Ubuntu 20.04.2 LTS + Clang 12 with ASan Vim Version : master(2446ec9) - Tue Oct 26 12:00:01 2021 +0100
Steps to reproduce:
git clone https://github.com/vim/vim LD=lld-12 AS=llvm-as-12 AR=llvm-ar-12 RANLIB=llvm-ranlib-12 CC=clang-12 CXX=clang++-12 CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address" LDFLAGS="-ldl -fsanitize=address" ./configure --with-features=huge --enable-gui=none && make Download POC from This URL ./vim -u NONE -X -Z -e -s -S POC -c :qa! Sanitizer output:
================================================================= ==127746==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000012901 at pc 0x000000ddec5e bp 0x7ffec368f860 sp 0x7ffec368f858 READ of size 1 at 0x621000012901 thread T0 #0 0xddec5d in gchar_cursor /src/fuzzer_44/triage_yeni/vim/src/misc1.c:532:17 #1 0xf1ea2f in adjust_cursor_eol /src/fuzzer_44/triage_yeni/vim/src/ops.c:1830:9 #2 0x12d7885 in do_put /src/fuzzer_44/triage_yeni/vim/src/register.c:2250:5 #3 0x94ff7b in do_one_cmd /src/fuzzer_44/triage_yeni/vim/src/ex_docmd.c:2614:2 #4 0x94ff7b in do_cmdline /src/fuzzer_44/triage_yeni/vim/src/ex_docmd.c:1000:17 #5 0x136cde4 in do_source /src/fuzzer_44/triage_yeni/vim/src/scriptfile.c:1406:5 #6 0x13699e1 in cmd_source /src/fuzzer_44/triage_yeni/vim/src/scriptfile.c:971:14 #7 0x13699e1 in ex_source /src/fuzzer_44/triage_yeni/vim/src/scriptfile.c:997:2 #8 0x94ff7b in do_one_cmd /src/fuzzer_44/triage_yeni/vim/src/ex_docmd.c:2614:2 #9 0x94ff7b in do_cmdline /src/fuzzer_44/triage_yeni/vim/src/ex_docmd.c:1000:17 #10 0x1bcecfc in exe_commands /src/fuzzer_44/triage_yeni/vim/src/main.c:3081:2 #11 0x1bcecfc in vim_main2 /src/fuzzer_44/triage_yeni/vim/src/main.c:773:2 #12 0x1bc5a8f in main /src/fuzzer_44/triage_yeni/vim/src/main.c:425:12 #13 0x7fa9ba98d0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2) #14 0x41f64d in _start (/src/fuzzer_44/triage_yeni/vim/src/vim+0x41f64d)
0x621000012901 is located 1 bytes to the right of 4096-byte region [0x621000011900,0x621000012900) allocated by thread T0 here: #0 0x49a8ad in malloc (/src/fuzzer_44/triage_yeni/vim/src/vim+0x49a8ad) #1 0x4cc2cb in lalloc /src/fuzzer_44/triage_yeni/vim/src/alloc.c:244:11
SUMMARY: AddressSanitizer: heap-buffer-overflow /src/fuzzer_44/triage_yeni/vim/src/misc1.c:532:17 in gchar_cursor Shadow bytes around the buggy address: 0x0c427fffa4d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fffa4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fffa4f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fffa500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c427fffa510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =>0x0c427fffa520:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fffa530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fffa540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fffa550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fffa560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x0c427fffa570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb Shadow gap: cc ==127746==ABORTING References:
CWE-122: Heap-based Buffer Overflow - https://cwe.mitre.org/data/definitions/122.html
This vulnerability is capable of crashing software, bypass protection mechanism, modify of memory, and successful exploitation may lead to code execution
References Cem Onat Karagun