4.7

CVE-2023-48706

Exploit

Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite

Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive `:s` call causes free-ing of memory which may later then be accessed by the initial `:s` command. The user must intentionally execute the payload and the whole process is a bit tricky to do since it seems to work only reliably for the very first :s command. It may also cause a crash of Vim. Version 9.0.2121 contains a fix for this issue.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Vim ≫ Vim Version < 9.0.2121
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.44% 0.351
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.7 1 3.6
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
security-advisories@github.com 3.6 1 2.5
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DNMFS3IH74KEMMESOA3EOB6MZ56TWGFF/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IVA7K73WHQH4KVFDJQ7ELIUD2WK5ZT5E/
http://www.openwall.com/lists/oss-security/2023/11/22/3
Patch
Third Party Advisory
Mailing List
https://github.com/gandalf4a/crash_report/blob/main/vim/vim_huaf
Exploit
https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb
Patch
https://github.com/vim/vim/pull/13552
Patch
Issue Tracking
https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q
Vendor Advisory
Exploit
https://security.netapp.com/advisory/ntap-20240105-0001/