Lucene search
Janette8853F53D9A-BA8A-4985-B7BA-23EFBE6833BEHistoryAug 23, 2022 - 5:17 a.m.
Use After Free in function qf_fill_buffer
2022-08-2305:17:55
janette88
www.huntr.dev
5
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
21.8%
Description
Use After Free in function qf_fill_buffer at vim/src/quickfix.c:4790
vim version
git log
commit adce965162dd89bf29ee0e5baf53652e7515762c (HEAD -> master, tag: v9.0.0246, origin/master, origin/HEAD)
Proof of Concept
./vim -u NONE -X -Z -e -s -S /home/fuzz/test/poc5_huaf.dat -c :qa!
=================================================================
==27777==ERROR: AddressSanitizer: heap-use-after-free on address 0x6070000028f0 at pc 0x56047d532883 bp 0x7fff2a81fa80 sp 0x7fff2a81fa70
READ of size 4 at 0x6070000028f0 thread T0
#0 0x56047d532882 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4790
#1 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#2 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#3 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#4 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#5 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#6 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#7 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#8 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#9 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#10 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#11 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#12 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#13 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#14 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#15 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#16 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#17 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#18 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#19 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#20 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#21 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#22 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#23 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#24 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#25 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#26 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#27 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#28 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#29 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#30 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#31 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#32 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#33 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#34 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#35 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#36 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#37 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#38 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#39 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#40 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#41 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#42 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#43 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#44 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#45 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#46 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#47 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#48 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#49 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#50 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#51 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#52 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#53 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#54 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#55 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#56 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#57 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#58 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#59 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#60 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#61 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#62 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#63 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#64 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#65 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#66 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#67 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#68 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#69 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#70 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#71 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#72 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#73 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#74 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#75 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#76 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#77 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#78 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#79 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#80 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#81 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#82 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#83 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#84 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#85 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#86 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#87 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#88 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#89 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#90 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#91 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#92 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#93 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#94 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#95 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#96 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#97 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#98 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#99 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#100 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#101 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#102 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#103 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#104 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#105 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#106 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#107 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#108 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#109 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#110 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#111 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#112 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#113 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#114 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#115 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#116 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#117 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#118 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#119 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#120 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#121 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#122 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#123 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#124 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#125 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#126 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#127 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#128 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#129 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#130 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#131 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#132 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#133 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#134 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#135 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#136 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#137 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#138 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#139 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#140 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#141 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#142 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#143 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#144 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#145 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#146 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#147 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#148 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#149 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#150 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#151 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#152 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#153 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#154 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#155 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#156 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#157 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#158 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#159 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#160 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#161 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#162 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#163 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#164 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#165 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#166 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#167 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#168 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#169 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#170 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#171 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#172 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#173 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#174 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#175 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#176 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#177 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#178 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#179 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#180 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#181 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#182 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#183 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#184 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#185 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#186 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#187 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#188 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#189 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#190 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#191 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#192 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#193 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#194 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#195 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#196 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#197 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#198 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#199 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#200 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#201 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#202 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#203 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#204 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#205 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#206 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#207 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#208 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#209 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#210 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#211 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#212 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#213 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#214 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#215 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#216 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#217 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#218 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#219 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#220 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#221 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#222 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#223 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#224 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#225 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#226 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#227 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#228 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#229 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#230 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#231 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#232 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#233 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#234 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#235 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#236 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#237 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#238 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#239 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#240 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#241 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#242 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#243 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#244 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#245 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#246 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#247 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#248 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#249 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#250 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
0x6070000028f0 is located 32 bytes inside of 80-byte region [0x6070000028d0,0x607000002920)
freed by thread T0 here:
#0 0x7f206335140f in __interceptor_free ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:122
#1 0x56047d13653a in vim_free /home/fuzz/vim/src/alloc.c:625
#2 0x56047d52e780 in qf_free_items /home/fuzz/vim/src/quickfix.c:3921
#3 0x56047d52eb2a in qf_free /home/fuzz/vim/src/quickfix.c:3954
#4 0x56047d524e65 in qf_new_list /home/fuzz/vim/src/quickfix.c:1916
#5 0x56047d5242fc in qf_init_ext /home/fuzz/vim/src/quickfix.c:1734
#6 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#7 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#8 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#9 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#10 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#11 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#12 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#13 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#14 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#15 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#16 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#17 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#18 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#19 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#20 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#21 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#22 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#23 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#24 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#25 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#26 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#27 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#28 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#29 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
previously allocated by thread T0 here:
#0 0x7f2063351808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144
#1 0x56047d13628a in lalloc /home/fuzz/vim/src/alloc.c:246
#2 0x56047d1360fd in alloc_id /home/fuzz/vim/src/alloc.c:165
#3 0x56047d5256fb in qf_add_entry /home/fuzz/vim/src/quickfix.c:2113
#4 0x56047d5240b6 in qf_init_process_nextline /home/fuzz/vim/src/quickfix.c:1666
#5 0x56047d5245c4 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1778
#6 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#7 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#8 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#9 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#10 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#11 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#12 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#13 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#14 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
#15 0x56047d75ba3d in call_func /home/fuzz/vim/src/userfunc.c:3599
#16 0x56047d75a2cf in call_callback /home/fuzz/vim/src/userfunc.c:3344
#17 0x56047d5322b7 in call_qftf_func /home/fuzz/vim/src/quickfix.c:4702
#18 0x56047d5327b1 in qf_fill_buffer /home/fuzz/vim/src/quickfix.c:4770
#19 0x56047d5314c4 in qf_update_buffer /home/fuzz/vim/src/quickfix.c:4562
#20 0x56047d5249e5 in qf_init_ext /home/fuzz/vim/src/quickfix.c:1819
#21 0x56047d5404f3 in cexpr_core /home/fuzz/vim/src/quickfix.c:8015
#22 0x56047d540828 in ex_cexpr /home/fuzz/vim/src/quickfix.c:8067
#23 0x56047d2bf5a5 in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2570
#24 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#25 0x56047d745380 in do_ucmd /home/fuzz/vim/src/usercmd.c:1892
#26 0x56047d2bf4da in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2562
#27 0x56047d2b6848 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:992
#28 0x56047d757f3b in call_user_func /home/fuzz/vim/src/userfunc.c:2886
#29 0x56047d759189 in call_user_func_check /home/fuzz/vim/src/userfunc.c:3043
SUMMARY: AddressSanitizer: heap-use-after-free /home/fuzz/vim/src/quickfix.c:4790 in qf_fill_buffer
Shadow bytes around the buggy address:
0x0c0e7fff84c0: fd fd fa fa fa fa fd fd fd fd fd fd fd fd fd fd
0x0c0e7fff84d0: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fa fa
0x0c0e7fff84e0: fa fa fd fd fd fd fd fd fd fd fd fd fa fa fa fa
0x0c0e7fff84f0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fd fd
0x0c0e7fff8500: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
=>0x0c0e7fff8510: fd fd fd fd fd fd fa fa fa fa fd fd fd fd[fd]fd
0x0c0e7fff8520: fd fd fd fd fa fa fa fa 00 00 00 00 00 00 00 00
0x0c0e7fff8530: 00 00 fa fa fa fa 00 00 00 00 00 00 00 00 00 00
0x0c0e7fff8540: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 fa fa
0x0c0e7fff8550: fa fa 00 00 00 00 00 00 00 00 00 00 fa fa fa fa
0x0c0e7fff8560: 00 00 00 00 00 00 00 00 00 00 fa fa fa fa 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==27777==ABORTING
poc download url:
Related
ubuntucve
ubuntucve
CVE-2022-2982
2022-08-25 00:00:00
cve
cve
CVE-2022-2982
2022-08-25 20:15:00
prion
prion
Design/Logic Flaw
2022-08-25 20:15:00
debiancve
debiancve
CVE-2022-2982
2022-08-25 20:15:00
osv
osv
CVE-2022-2982
2022-08-25 20:15:00
vim vulnerabilities
2023-08-21 05:45:06
veracode
veracode
Use-After-Free
2022-09-14 17:27:53
redhatcve
redhatcve
CVE-2022-2982
2022-09-02 12:32:28
cnvd
cnvd
Vim Resource Management Error Vulnerability (CNVD-2022-68088)
2022-08-30 00:00:00
alpinelinux
alpinelinux
CVE-2022-2982
2022-08-25 20:15:00
cbl_mariner
cbl_mariner
CVE-2022-2982 affecting package vim for versions less than 9.0.0325-1
2022-09-16 06:05:42
CVE-2022-2982 affecting package vim 9.0.0181-1
2022-09-17 05:56:39
redos
redos
ROS-20220909-01
2022-09-09 00:00:00
openvas
openvas
Fedora: Security Advisory for vim (FEDORA-2022-b9edf60581)
2022-09-15 00:00:00
SUSE: Security Advisory (SUSE-SU-2022:4282-1)
2022-11-30 00:00:00
Ubuntu: Security Advisory (USN-6302-1)
2023-08-21 00:00:00
fedora
fedora
[SECURITY] Fedora 37 Update: vim-9.0.412-1.fc37
2022-09-14 00:28:23
nessus
nessus
Ubuntu 18.04 ESM / 20.04 LTS / 22.04 LTS : Vim vulnerabilities (USN-6302-1)
2023-08-21 00:00:00
Amazon Linux AMI : vim (ALAS-2023-1716)
2023-04-06 00:00:00
SUSE SLED15 / SLES15 Security Update : vim (SUSE-SU-2022:4282-1)
2022-11-30 00:00:00
amazon
amazon
Important: vim
2023-03-30 22:50:00
Low: vim
2022-10-17 21:46:00
ubuntu
ubuntu
Vim vulnerabilities
2023-08-21 00:00:00
cloudfoundry
cloudfoundry
USN-6302-1: Vim vulnerabilities | Cloud Foundry
2023-10-05 00:00:00
photon
photon
Critical Photon OS Security Update - PHSA-2023-4.0-0380
2023-04-25 00:00:00
Critical Photon OS Security Update - PHSA-2023-3.0-0568
2023-04-19 00:00:00
mageia
mageia
Updated vim packages fix security vulnerability
2022-11-19 01:50:51
gentoo
gentoo
Vim, gVim: Multiple Vulnerabilities
2023-05-03 00:00:00
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.4 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:M/Au:N/C:P/I:P/A:P
0.001 Low
EPSS
Percentile
21.8%
Related for 53F53D9A-BA8A-4985-B7BA-23EFBE6833BE