Heap-based Buffer Overflow in vim/vim

Valid

Reported on

Nov 12th 2021


Description

Greetings,

A Heap-based Buffer Overflow issue was discovered in Vim.

The POC file is reduced to the absolute minimum to reproduce the problem. Please see sanitizer output and the "trimmed" POC file link below.

System info OS version : Ubuntu 20.04.2 LTS + Clang 12 with ASan Vim Version : master(58ef8a3) - Fri Nov 12 11:25:11 2021 +0000

Steps to reproduce:

git clone https://github.com/vim/vim
LD=lld-12 AS=llvm-as-12 AR=llvm-ar-12 RANLIB=llvm-ranlib-12 CC=clang-12 CXX=clang++-12 CFLAGS="-fsanitize=address" CXXFLAGS="-fsanitize=address" LDFLAGS="-ldl -fsanitize=address" ./configure --with-features=huge --enable-gui=none && make
  1. Download POC from This URL
./vim -u NONE -X -Z -e -s -S POC -c :qa!

Sanitizer output:

=================================================================
==135716==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x621000012900 at pc 0x000000accc0e bp 0x7fffe33c6730 sp 0x7fffe33c6728
READ of size 1 at 0x621000012900 thread T0
    #0 0xaccc0d in grab_file_name /src/fuzzer11/triage_yeni/vim/src/findfile.c:1947:27
    #1 0x19b3220 in do_window /src/fuzzer11/triage_yeni/vim/src/window.c:522:9
    #2 0xe845de in normal_cmd /src/fuzzer11/triage_yeni/vim/src/normal.c:1099:5
    #3 0x9aefb4 in exec_normal /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c
    #4 0x9ad0aa in exec_normal_cmd /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:8548:5
    #5 0x9ad0aa in ex_normal /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:8466:6
    #6 0x94ff7b in do_one_cmd /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:2614:2
    #7 0x94ff7b in do_cmdline /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:1000:17
    #8 0x5064ee in apply_autocmds_group /src/fuzzer11/triage_yeni/vim/src/autocmd.c:2153:2
    #9 0x50da64 in apply_autocmds /src/fuzzer11/triage_yeni/vim/src/autocmd.c:1651:12
    #10 0x52a0f5 in buf_freeall /src/fuzzer11/triage_yeni/vim/src/buffer.c:802:6
    #11 0x531471 in buflist_new /src/fuzzer11/triage_yeni/vim/src/buffer.c:2103:2
    #12 0x55c374 in buflist_add /src/fuzzer11/triage_yeni/vim/src/buffer.c:3515:11
    #13 0x4d88c7 in alist_add /src/fuzzer11/triage_yeni/vim/src/arglist.c:206:6
    #14 0x4d88c7 in alist_set /src/fuzzer11/triage_yeni/vim/src/arglist.c:173:6
    #15 0x4dbf91 in do_arglist /src/fuzzer11/triage_yeni/vim/src/arglist.c:484:6
    #16 0x4e1aba in ex_next /src/fuzzer11/triage_yeni/vim/src/arglist.c:751:10
    #17 0x94ff7b in do_one_cmd /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:2614:2
    #18 0x94ff7b in do_cmdline /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:1000:17
    #19 0x136cde4 in do_source /src/fuzzer11/triage_yeni/vim/src/scriptfile.c:1406:5
    #20 0x13699e1 in cmd_source /src/fuzzer11/triage_yeni/vim/src/scriptfile.c:971:14
    #21 0x13699e1 in ex_source /src/fuzzer11/triage_yeni/vim/src/scriptfile.c:997:2
    #22 0x94ff7b in do_one_cmd /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:2614:2
    #23 0x94ff7b in do_cmdline /src/fuzzer11/triage_yeni/vim/src/ex_docmd.c:1000:17
    #24 0x1bcecfc in exe_commands /src/fuzzer11/triage_yeni/vim/src/main.c:3081:2
    #25 0x1bcecfc in vim_main2 /src/fuzzer11/triage_yeni/vim/src/main.c:773:2
    #26 0x1bc5a8f in main /src/fuzzer11/triage_yeni/vim/src/main.c:425:12
    #27 0x7f9daa6ad0b2 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
    #28 0x41f64d in _start (/src/fuzzer11/triage_yeni/vim/src/vim+0x41f64d)

0x621000012900 is located 0 bytes to the right of 4096-byte region [0x621000011900,0x621000012900)
allocated by thread T0 here:
    #0 0x49a8ad in malloc (/src/fuzzer11/triage_yeni/vim/src/vim+0x49a8ad)
    #1 0x4cc2cb in lalloc /src/fuzzer11/triage_yeni/vim/src/alloc.c:244:11

SUMMARY: AddressSanitizer: heap-buffer-overflow /src/fuzzer11/triage_yeni/vim/src/findfile.c:1947:27 in grab_file_name
Shadow bytes around the buggy address:
  0x0c427fffa4d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa4e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa4f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0c427fffa510: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c427fffa520:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa530: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa540: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa550: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa560: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fffa570: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==135716==ABORTING

References:

CWE-122: Heap-based Buffer Overflow - https://cwe.mitre.org/data/definitions/122.html

This vulnerability is capable of crashing software, bypass protection mechanism, modify of memory, and successful exploitation may lead to code execution

References

We are processing your report and will contact the vim team within 24 hours. a month ago
We have contacted a member of the vim team and are waiting to hear back 25 days ago
We have contacted a member of the vim team and are waiting to hear back 25 days ago
We have sent a follow up to the vim team. We will try again in 7 days. 22 days ago
We have sent a follow up to the vim team. We will try again in 7 days. 22 days ago
Bram Moolenaar
21 days ago

I can reproduce it.

Bram Moolenaar validated this vulnerability 21 days ago
Cem has been awarded the disclosure bounty
The fix bounty is now up for grabs
Bram Moolenaar
21 days ago

Fix is in patch 8.2.3611, please verify

Cem
20 days ago

Researcher


Looks good - tested with patch 8.2.3616.

Bram Moolenaar confirmed that a fix has been merged on 615ddd 20 days ago
Bram Moolenaar has been awarded the fix bounty
Jamie Slome
19 days ago

Admin


CVE published! 🎊

Jamie Slome
15 days ago

Admin


@ cemonatk 👋 it looks like a bug on our side caused the disclosure bounty to be set to $355 erroneously. We have restored it to the reward shown at the point of disclosure ($0). We apologize for the inconvenience or confusion caused.