Heap-Use-After-Free Vulnerability in Vim: Integer Overflow Risk
Summary
DEBIAN-CVE-2023-46246: Vim is an improved version of the good old UNIX editor Vi. Affects vim versions < 2:9.0.2087-1. Fixed in 2:9.0.2087-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vim is an advanced text editor that enhances the classic UNIX editor, Vi. It is widely used for programming and text editing due to its powerful features, including syntax highlighting, multi-level undo, and extensive plugin support. However, it is susceptible to vulnerabilities that can compromise its stability and security, such as the one identified in this report.
Vulnerability Detail
The vulnerability arises from a heap-use-after-free condition in the Vim editor, specifically in the function 'ga_grow_inner' located in 'src/alloc.c'. This memory allocation is freed in 'src/ex_docmd.c' within the 'do_cmdline' function and subsequently accessed again in 'src/cmdhist.c'. The issue is triggered when the ':history' command is used with an argument that exceeds the accepted value, leading to an integer overflow and potential use-after-free exploitation. This could allow an attacker to execute arbitrary code or crash the application.
How To Fix
Minimum fixed version
2:9.0.2087-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade vimTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to update to the patched version as mentioned above.
Conclusion
The heap-use-after-free vulnerability in Vim poses a serious risk due to its potential for exploitation through integer overflow. Users are strongly advised to update to the latest patched version to mitigate this risk. Regular monitoring for vulnerabilities using tools like Vulert can further enhance software security.
See every vulnerability recorded for vim →
FAQ
The vulnerability is a heap-use-after-free issue caused by an integer overflow when using the ':history' command.
If you are using Vim versions prior to 2:9.0.2087-1, you are at risk. You can check your version by running 'vim --version' in the terminal.
Exploitation of this vulnerability could lead to arbitrary code execution or application crashes, posing a significant security risk.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check for vulnerabilities in real-time without installation.
Detailed information can be found in the official Debian CVE database or by visiting the Vulert playground at Vulert Scanner.
References
Related vulnerabilities
Recent vulnerabilities recorded for vim.
