Lucene search
SoaaronyC867EB0A-AA8B-4946-A621-510350673883HistorySep 04, 2023 - 12:40 p.m.
heap-buffer-overflow in function vim_regsub_both
2023-09-0412:40:07
soaarony
www.huntr.dev
9
proof of concept
vim
buffer overflow
memory safety
address sanitizer
vulnerability
version control
0.001 Low
EPSS
Percentile
19.9%
Description
heap-buffer-overflow in vim_regsub_both at regexp.c:2482
Version
git log
commit e073a8b79f1d3398b27f35b7920746b564a169e9 (HEAD -> master, origin/master, origin/HEAD)
Proof of Concept
./vim -u NONE -i NONE -n -m -X -Z -e -s -S vim_regsub_both_poc -c :qa!
helplang=en readonly updatecount=0nowritenoloadplugins scroll=5 viminfofile=NONE fileencodings=ucs-bom,utf-8,default,latin1
helplang=en readonly updatecount=0nowritenoloadplugins scroll=3 viminfofile=NONE fileencodings=ucs-bom,utf-8,default,latin1
helplang=en readonly spell viminfofile=NONEnoloadplugins scroll=2 updatecount=0nowrite fileencodings=ucs-bom,utf-8,default,latin1
helplang=en readonly spell viminfofile=NONEnoloadplugins scroll=2 updatecount=0nowrite fileencodings=ucs-bom,utf-8,default,latin1
helplang=en readonly spell viminfofile=NONEnoloadplugins scroll=1 updatecount=0nowrite fileencodings=ucs-bom,utf-8,default,latin1
helplang=en readonly spell viminfofile=NONEnoloadplugins scroll=1 updatecount=0nowrite fileencodings=ucs-bom,utf-8,default,latin1
helplang=en readonly spell viminfofile=NONEnoloadplugins scroll=1 updatecount=0nowrite fileencodings=ucs-bom,utf-8,default,latin1
=================================================================
==567534==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60600000bc37 at pc 0x56014d6ccf64 bp 0x7ffd19b5cd00 sp 0x7ffd19b5ccf0
WRITE of size 1 at 0x60600000bc37 thread T0
#0 0x56014d6ccf63 in vim_regsub_both /home/limweicheng/Desktop/Fuzz/vim/src/regexp.c:2482
#1 0x56014d7ac3d6 in vim_regsub_multi /home/limweicheng/Desktop/Fuzz/vim/src/regexp.c:1972
#2 0x56014d0cdf70 in ex_substitute /home/limweicheng/Desktop/Fuzz/vim/src/ex_cmds.c:4660
#3 0x56014d141816 in do_one_cmd /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:2582
#4 0x56014d141816 in do_cmdline /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:994
#5 0x56014d820415 in do_source_ext /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1762
#6 0x56014d826e5b in cmd_source /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1236
#7 0x56014d141816 in do_one_cmd /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:2582
#8 0x56014d141816 in do_cmdline /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:994
#9 0x56014d820415 in do_source_ext /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1762
#10 0x56014d826e5b in cmd_source /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1236
#11 0x56014d141816 in do_one_cmd /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:2582
#12 0x56014d141816 in do_cmdline /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:994
#13 0x56014d820415 in do_source_ext /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1762
#14 0x56014d826e5b in cmd_source /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1236
#15 0x56014d141816 in do_one_cmd /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:2582
#16 0x56014d141816 in do_cmdline /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:994
#17 0x56014d820415 in do_source_ext /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1762
#18 0x56014d826e5b in cmd_source /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1236
#19 0x56014d141816 in do_one_cmd /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:2582
#20 0x56014d141816 in do_cmdline /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:994
#21 0x56014d820415 in do_source_ext /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1762
#22 0x56014d826e5b in cmd_source /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1236
#23 0x56014d141816 in do_one_cmd /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:2582
#24 0x56014d141816 in do_cmdline /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:994
#25 0x56014d820415 in do_source_ext /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1762
#26 0x56014d826e5b in cmd_source /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1236
#27 0x56014d141816 in do_one_cmd /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:2582
#28 0x56014d141816 in do_cmdline /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:994
#29 0x56014d820415 in do_source_ext /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1762
#30 0x56014d826e5b in cmd_source /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1236
#31 0x56014d141816 in do_one_cmd /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:2582
#32 0x56014d141816 in do_cmdline /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:994
#33 0x56014d820415 in do_source_ext /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1762
#34 0x56014d826b60 in do_source /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1908
#35 0x56014d826b60 in cmd_source /home/limweicheng/Desktop/Fuzz/vim/src/scriptfile.c:1253
#36 0x56014d141816 in do_one_cmd /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:2582
#37 0x56014d141816 in do_cmdline /home/limweicheng/Desktop/Fuzz/vim/src/ex_docmd.c:994
#38 0x56014de98d21 in exe_commands /home/limweicheng/Desktop/Fuzz/vim/src/main.c:3173
#39 0x56014de98d21 in vim_main2 /home/limweicheng/Desktop/Fuzz/vim/src/main.c:790
#40 0x56014cd6d275 in main /home/limweicheng/Desktop/Fuzz/vim/src/main.c:441
#41 0x7f8d8199bd8f in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#42 0x7f8d8199be3f in __libc_start_main_impl ../csu/libc-start.c:392
#43 0x56014cd73f94 in _start (/home/limweicheng/Desktop/Fuzz/vim/src/vim+0x1a0f94)
0x60600000bc37 is located 3 bytes to the right of 52-byte region [0x60600000bc00,0x60600000bc34)
allocated by thread T0 here:
#0 0x7f8d82435867 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:145
#1 0x56014cd744ea in lalloc /home/limweicheng/Desktop/Fuzz/vim/src/alloc.c:246
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/limweicheng/Desktop/Fuzz/vim/src/regexp.c:2482 in vim_regsub_both
Shadow bytes around the buggy address:
0x0c0c7fff9730: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
0x0c0c7fff9740: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
0x0c0c7fff9750: fd fd fd fd fd fd fd fa fa fa fa fa fd fd fd fd
0x0c0c7fff9760: fd fd fd fa fa fa fa fa fd fd fd fd fd fd fd fa
0x0c0c7fff9770: fa fa fa fa 00 00 00 00 00 00 00 00 fa fa fa fa
=>0x0c0c7fff9780: 00 00 00 00 00 00[04]fa fa fa fa fa fa fa fa fa
0x0c0c7fff9790: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff97a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff97b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff97c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff97d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==567534==ABORTING
Related
veracode
veracode
Heap-based Buffer Overflow
2023-10-02 16:25:03
alpinelinux
alpinelinux
CVE-2023-4781
2023-09-05 19:15:49
debiancve
debiancve
CVE-2023-4781
2023-09-05 19:15:49
ubuntucve
ubuntucve
CVE-2023-4781
2023-09-05 00:00:00
nvd
nvd
CVE-2023-4781
2023-09-05 19:15:49
prion
prion
Heap overflow
2023-09-05 19:15:00
cbl_mariner
cbl_mariner
CVE-2023-4781 affecting package vim for versions less than 9.0.1897-1
2023-09-27 18:02:50
redhatcve
redhatcve
CVE-2023-4781
2023-09-06 05:06:14
cvelist
cvelist
CVE-2023-4781 Heap-based Buffer Overflow in vim/vim
2023-09-05 18:32:30
nessus
nessus
CBL Mariner 2.0 Security Update: vim (CVE-2023-4781)
2023-09-28 00:00:00
Debian DLA-3588-1 : vim - LTS security update
2023-09-29 00:00:00
SUSE SLES12 Security Update : vim (SUSE-SU-2023:3942-1)
2023-10-04 00:00:00
cve
cve
CVE-2023-4781
2023-09-05 19:15:49
cnvd
cnvd
Vim buffer overflow vulnerability (CNVD-2023-72249)
2023-09-11 00:00:00
osv
osv
vim - security update
2023-09-29 00:00:00
vim vulnerabilities
2023-10-25 16:47:19
openvas
openvas
Debian: Security Advisory (DLA-3588-1)
2023-10-02 00:00:00
openSUSE: Security Advisory for vim (SUSE-SU-2023:3955-1)
2024-03-04 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:3942-1)
2023-10-04 00:00:00
debian
debian
[SECURITY] [DLA 3588-1] vim security update
2023-09-29 13:52:33
photon
photon
Important Photon OS Security Update - PHSA-2023-3.0-0647
2023-09-12 00:00:00
Critical Photon OS Security Update - PHSA-2023-5.0-0091
2023-09-09 00:00:00
Important Photon OS Security Update - PHSA-2023-4.0-0467
2023-09-08 00:00:00
amazon
amazon
Important: vim
2023-09-13 23:15:00
Important: vim
2023-09-27 22:48:00
redos
redos
ROS-20240329-16
2024-03-29 00:00:00
ubuntu
ubuntu
Vim vulnerabilities
2023-10-25 00:00:00
cloudfoundry
cloudfoundry
USN-6452-1: Vim vulnerabilities | Cloud Foundry
2023-12-04 00:00:00
apple
apple
About the security content of macOS Sonoma 14.1
2023-10-25 00:00:00
