CVE-2021-3974

vim is vulnerable to Use After Free

vim is vulnerable to Use After Free

Vim is a highly configurable text editor for efficiently creating and changing any kind of text.

Security Fix(es):

vim is vulnerable to Use After Free.(CVE-2021-3974)

vim is vulnerable to Heap-based Buffer Overflow.(CVE-2021-3973)

vim is vulnerable to Use After Free

• CVE-2021-3974: fix using freed memory with regexp using a mark
• CVE-2021-3984: fix illegal memory access when C-indenting
• CVE-2021-3973: fix crash when using CTRL-W f without finding a file name
• CVE-2021-4019: fix buffer overflow with long help argument
• CVE-2021-4069: fix using freed memory in open command

• SECURITY UPDATE: Using freed memory with regexp using a mark
  • debian/patches/CVE-2021-3974.patch: Get the line again after getting the mark position
  • CVE-2021-3974
• SECURITY UPDATE: Illegal memory access when C-indenting
  • debian/patches/CVE-2021-3984.patch: Also set the cursor column
  • CVE-2021-3984
• SECURITY UPDATE: Crash when using CTRL-W f without finding a file name
  • debian/patches/CVE-2021-3973.patch: Bail out when the file name length is zero
  • CVE-2021-3973
• SECURITY UPDATE: Buffer overflow with long help argument
  • debian/patches/CVE-2021-4019.patch: Use snprintf
  • CVE-2021-4019
• SECURITY UPDATE: Using freed memory in open command
  • debian/patches/CVE-2021-4069.patch: Make a copy of the current line
  • CVE-2021-4069

• SECURITY UPDATE: Using freed memory with regexp using a mark
  • debian/patches/CVE-2021-3974.patch: Get the line again after getting the mark position
  • CVE-2021-3974
• SECURITY UPDATE: Illegal memory access when C-indenting
  • debian/patches/CVE-2021-3984.patch: Also set the cursor column
  • CVE-2021-3984
• SECURITY UPDATE: Crash when using CTRL-W f without finding a file name
  • debian/patches/CVE-2021-3973.patch: Bail out when the file name length is zero
  • CVE-2021-3973
• SECURITY UPDATE: Buffer overflow with long help argument
  • debian/patches/CVE-2021-4019.patch: Use snprintf
  • CVE-2021-4019
• SECURITY UPDATE: Using freed memory in open command
  • debian/patches/CVE-2021-4069.patch: Make a copy of the current line
  • CVE-2021-4069

• SECURITY UPDATE: Using freed memory with regexp using a mark
  • debian/patches/CVE-2021-3974.patch: Get the line again after getting the mark position
  • CVE-2021-3974
• SECURITY UPDATE: Illegal memory access when C-indenting
  • debian/patches/CVE-2021-3984.patch: Also set the cursor column
  • CVE-2021-3984
• SECURITY UPDATE: Crash when using CTRL-W f without finding a file name
  • debian/patches/CVE-2021-3973.patch: Bail out when the file name length is zero
  • CVE-2021-3973
• SECURITY UPDATE: Buffer overflow with long help argument
  • debian/patches/CVE-2021-4019.patch: Use snprintf
  • CVE-2021-4019
• SECURITY UPDATE: Using freed memory in open command
  • debian/patches/CVE-2021-4069.patch: Make a copy of the current line
  • CVE-2021-4069

• CVE-2021-3974: fix using freed memory with regexp using a mark
• CVE-2021-3984: fix illegal memory access when C-indenting
• CVE-2021-3973: fix crash when using CTRL-W f without finding a file name
• CVE-2021-4019: fix buffer overflow with long help argument
• CVE-2021-4069: fix using freed memory in open command

• CVE-2021-3928: in suggest_trie_walk() only credit a non-word-char boundary with SCORE_NONWORD when preword is non-empty, so spell suggestions do not read uninitialized memory behind preword.
• CVE-2021-3974: in nfa_regmatch() NFA_MARK / NFA_MARK_GT / NFA_MARK_LT, save reginput - regline and re-fetch regline via reg_getline() after getmark_buf() so use-after-free cannot occur when getmark_buf flushes the current line.
• CVE-2022-0368: call check_pos(curbuf, &VIsual) at the end of u_undo_end() when Visual mode is active, so an undo that shortens the buffer cannot leave VIsual pointing past end-of-line / end- of-buffer. Adds a check_pos() helper in misc2.c.
• CVE-2022-0696: in win_new_tabpage() and goto_tabpage_tp(), refuse to switch/create a tabpage while cmdwin_type != 0, emitting e_cmdwin instead of crashing on cmdline-window re-entry.
• CVE-2022-1629: in find_next_quote(), after advancing past an escape character return -1 if the next byte is NUL so a trailing backslash cannot be read past end-of-line.
• CVE-2022-1735: call new check_visual_pos() helper from changed_common() (misc1.c) and stop_insert() (edit.c) whenever Visual mode is active so a change that shrinks the buffer cannot leave VIsual pointing past end-of-line / end-of-buffer.
• CVE-2022-1771: cap getcmdline() recursion at 50 via a static depth counter, emitting E169 "Command too recursive" on overflow to prevent crash from self-recursive cmdline input (e.g. the "=@" register loop).
• CVE-2022-1898: in nv_brackets(), copy the identifier under the cursor with vim_strnsave() before calling find_pattern_in_path() for "]d"/"[d", so that a match in a modified/freed line cannot cause a use-after-free on ptr.
• CVE-2022-1968: add get_line_and_copy() helper in search.c and use it instead of ml_get() in find_pattern_in_path(), so the regexp cannot leave line pointing into freed buffer memory when a mark invalidates the current line.
• CVE-2022-2124: in current_quote() (search.c), break out of the selection-scan loop when line[i] is NUL so a changed line does not cause a read past end-of-line while iterating up to col_end.

• CVE-2021-3928: in suggest_trie_walk() only credit a non-word-char boundary with SCORE_NONWORD when preword is non-empty, so spell suggestions do not read uninitialized memory behind preword.
• CVE-2021-3974: in nfa_regmatch() NFA_MARK / NFA_MARK_GT / NFA_MARK_LT, save reginput - regline and re-fetch regline via reg_getline() after getmark_buf() so use-after-free cannot occur when getmark_buf flushes the current line.
• CVE-2022-0368: call check_pos(curbuf, &VIsual) at the end of u_undo_end() when Visual mode is active, so an undo that shortens the buffer cannot leave VIsual pointing past end-of-line / end- of-buffer. Adds a check_pos() helper in misc2.c.
• CVE-2022-0696: in win_new_tabpage() and goto_tabpage_tp(), refuse to switch/create a tabpage while cmdwin_type != 0, emitting e_cmdwin instead of crashing on cmdline-window re-entry.
• CVE-2022-1629: in find_next_quote(), after advancing past an escape character return -1 if the next byte is NUL so a trailing backslash cannot be read past end-of-line.
• CVE-2022-1735: call new check_visual_pos() helper from changed_common() (misc1.c) and stop_insert() (edit.c) whenever Visual mode is active so a change that shrinks the buffer cannot leave VIsual pointing past end-of-line / end-of-buffer.
• CVE-2022-1771: cap getcmdline() recursion at 50 via a static depth counter, emitting E169 "Command too recursive" on overflow to prevent crash from self-recursive cmdline input (e.g. the "=@" register loop).
• CVE-2022-1898: in nv_brackets(), copy the identifier under the cursor with vim_strnsave() before calling find_pattern_in_path() for "]d"/"[d", so that a match in a modified/freed line cannot cause a use-after-free on ptr.
• CVE-2022-1968: add get_line_and_copy() helper in search.c and use it instead of ml_get() in find_pattern_in_path(), so the regexp cannot leave line pointing into freed buffer memory when a mark invalidates the current line.
• CVE-2022-2124: in current_quote() (search.c), break out of the selection-scan loop when line[i] is NUL so a changed line does not cause a read past end-of-line while iterating up to col_end.

• CVE-2022-2125: fix out-of-bounds read in get_lisp_indent(); break out of the inner loop on NUL byte (indent.c, upstream patch 8.2.5122)
• CVE-2021-3974: fix use-after-free in nfa_regmatch() when a substitute callback frees the regline during a mark comparison; save col and re-fetch rex.line via reg_getline() after getmark_buf() (regexp.c + regexp_nfa.c, upstream patch 8.2.3612)
• CVE-2022-2206: fix OOB read after terminal resize lowers Rows below cmdline_row / msg_row; clamp both to Rows - 1 in check_shellsize() (term.c, upstream patch 8.2.5160)
• CVE-2022-2946: fix use-after-free in do_tag() when 'tagfunc' deletes the buffer; make a vim_strsave copy of the tagstack tagname before calling user code (tag.c, upstream patch 9.0.0246)
• CVE-2022-2286: fix heap-buffer-overflow in the Ctrl-E completion-stop path when the completion leader shrinks below the original text; bounds-check compl_len against replacement string length before ins_bytes_len() (insexpand.c, upstream patch 9.0.0020)

• CVE-2022-2125: fix out-of-bounds read in get_lisp_indent(); break out of the inner loop on NUL byte (indent.c, upstream patch 8.2.5122)
• CVE-2021-3974: fix use-after-free in nfa_regmatch() when a substitute callback frees the regline during a mark comparison; save col and re-fetch rex.line via reg_getline() after getmark_buf() (regexp.c + regexp_nfa.c, upstream patch 8.2.3612)
• CVE-2022-2206: fix OOB read after terminal resize lowers Rows below cmdline_row / msg_row; clamp both to Rows - 1 in check_shellsize() (term.c, upstream patch 8.2.5160)
• CVE-2022-2946: fix use-after-free in do_tag() when 'tagfunc' deletes the buffer; make a vim_strsave copy of the tagstack tagname before calling user code (tag.c, upstream patch 9.0.0246)
• CVE-2022-2286: fix heap-buffer-overflow in the Ctrl-E completion-stop path when the completion leader shrinks below the original text; bounds-check compl_len against replacement string length before ins_bytes_len() (insexpand.c, upstream patch 9.0.0020)

Multiple Heap-based Buffer Overflows Stack-based Buffer overflows and a use after free.

This update for vim fixes the following issues:

• CVE-2017-17087: Fixed information leak via .swp files (bsc#1070955).
• CVE-2021-3875: Fixed heap-based buffer overflow (bsc#1191770).
• CVE-2021-3903: Fixed heap-based buffer overflow (bsc#1192167).
• CVE-2021-3968: Fixed heap-based buffer overflow (bsc#1192902).
• CVE-2021-3973: Fixed heap-based buffer overflow (bsc#1192903).
• CVE-2021-3974: Fixed use-after-free (bsc#1192904).
• CVE-2021-4069: Fixed use-after-free in ex_open()in src/ex_docmd.c (bsc#1193466).
• CVE-2021-4136: Fixed heap-based buffer overflow (bsc#1193905).
• CVE-2021-4166: Fixed out-of-bounds read (bsc#1194093).
• CVE-2021-4192: Fixed use-after-free (bsc#1194217).
• CVE-2021-4193: Fixed out-of-bounds read (bsc#1194216).
• CVE-2022-0128: Fixed out-of-bounds read (bsc#1194388).
• CVE-2022-0213: Fixed heap-based buffer overflow (bsc#1194885).
• CVE-2022-0261: Fixed heap-based buffer overflow (bsc#1194872).
• CVE-2022-0318: Fixed heap-based buffer overflow (bsc#1195004).
• CVE-2022-0359: Fixed heap-based buffer overflow in init_ccline() in ex_getln.c (bsc#1195203).
• CVE-2022-0392: Fixed heap-based buffer overflow (bsc#1195332).
• CVE-2022-0407: Fixed heap-based buffer overflow (bsc#1195354).
• CVE-2022-0696: Fixed NULL pointer dereference (bsc#1196361).
• CVE-2022-1381: Fixed global heap buffer overflow in skip_range (bsc#1198596).
• CVE-2022-1420: Fixed out-of-range pointer offset (bsc#1198748).
• CVE-2022-1616: Fixed use-after-free in append_command (bsc#1199331).
• CVE-2022-1619: Fixed heap-based Buffer Overflow in function cmdline_erase_chars (bsc#1199333).
• CVE-2022-1620: Fixed NULL pointer dereference in function vim_regexec_string (bsc#1199334).
• CVE-2022-1733: Fixed heap-based buffer overflow in cindent.c (bsc#1199655).
• CVE-2022-1735: Fixed heap-based buffer overflow (bsc#1199651).
• CVE-2022-1771: Fixed stack exhaustion (bsc#1199693).
• CVE-2022-1785: Fixed out-of-bounds write (bsc#1199745).
• CVE-2022-1796: Fixed use-after-free in find_pattern_in_path (bsc#1199747).
• CVE-2022-1851: Fixed out-of-bounds read (bsc#1199936).
• CVE-2022-1897: Fixed out-of-bounds write (bsc#1200010).
• CVE-2022-1898: Fixed use-after-free (bsc#1200011).
• CVE-2022-1927: Fixed buffer over-read (bsc#1200012).

This update for vim fixes the following issues:

Updated to version 9.0.0814:

• Fixing bsc#1192478 VUL-1: CVE-2021-3928: vim: vim is vulnerable to Stack-based Buffer Overflow
• Fixing bsc#1203508 VUL-0: CVE-2022-3234: vim: Heap-based Buffer Overflow prior to 9.0.0483.
• Fixing bsc#1203509 VUL-1: CVE-2022-3235: vim: Use After Free in GitHub prior to 9.0.0490.
• Fixing bsc#1203820 VUL-0: CVE-2022-3324: vim: Stack-based Buffer Overflow in prior to 9.0.0598.
• Fixing bsc#1204779 VUL-0: CVE-2022-3705: vim: use after free in function qf_update_buffer of the file quickfix.c
• Fixing bsc#1203152 VUL-1: CVE-2022-2982: vim: use after free in qf_fill_buffer()
• Fixing bsc#1203796 VUL-1: CVE-2022-3296: vim: stack out of bounds read in ex_finally() in ex_eval.c
• Fixing bsc#1203797 VUL-1: CVE-2022-3297: vim: use-after-free in process_next_cpt_value() at insexpand.c
• Fixing bsc#1203110 VUL-1: CVE-2022-3099: vim: Use After Free in ex_docmd.c
• Fixing bsc#1203194 VUL-1: CVE-2022-3134: vim: use after free in do_tag()
• Fixing bsc#1203272 VUL-1: CVE-2022-3153: vim: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
• Fixing bsc#1203799 VUL-1: CVE-2022-3278: vim: NULL pointer dereference in eval_next_non_blank() in eval.c
• Fixing bsc#1203924 VUL-1: CVE-2022-3352: vim: vim: use after free
• Fixing bsc#1203155 VUL-1: CVE-2022-2980: vim: null pointer dereference in do_mouse()
• Fixing bsc#1202962 VUL-1: CVE-2022-3037: vim: Use After Free in vim prior to 9.0.0321
• Fixing bsc#1200884 Vim: Error on startup
• Fixing bsc#1200902 VUL-0: CVE-2022-2183: vim: Out-of-bounds Read through get_lisp_indent() Mon 13:32
• Fixing bsc#1200903 VUL-0: CVE-2022-2182: vim: Heap-based Buffer Overflow through parse_cmd_address() Tue 08:37
• Fixing bsc#1200904 VUL-0: CVE-2022-2175: vim: Buffer Over-read through cmdline_insert_reg() Tue 08:37
• Fixing bsc#1201249 VUL-0: CVE-2022-2304: vim: stack buffer overflow in spell_dump_compl()
• Fixing bsc#1201356 VUL-1: CVE-2022-2343: vim: Heap-based Buffer Overflow in GitHub repository vim prior to 9.0.0044
• Fixing bsc#1201359 VUL-1: CVE-2022-2344: vim: Another Heap-based Buffer Overflow vim prior to 9.0.0045
• Fixing bsc#1201363 VUL-1: CVE-2022-2345: vim: Use After Free in GitHub repository vim prior to 9.0.0046.
• Fixing bsc#1201620 vim: SLE-15-SP4-Full-x86_64-GM-Media1 and vim-plugin-tlib-1.27-bp154.2.18.noarch issue
• Fixing bsc#1202414 VUL-1: CVE-2022-2819: vim: Heap-based Buffer Overflow in compile_lock_unlock()
• Fixing bsc#1202552 VUL-1: CVE-2022-2874: vim: NULL Pointer Dereference in generate_loadvar()
• Fixing bsc#1200270 VUL-1: CVE-2022-1968: vim: use after free in utf_ptr2char
• Fixing bsc#1200697 VUL-1: CVE-2022-2124: vim: out of bounds read in current_quote()
• Fixing bsc#1200698 VUL-1: CVE-2022-2125: vim: out of bounds read in get_lisp_indent()
• Fixing bsc#1200700 VUL-1: CVE-2022-2126: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1200701 VUL-1: CVE-2022-2129: vim: out of bounds write in vim_regsub_both()
• Fixing bsc#1200732 VUL-1: CVE-2022-1720: vim: out of bounds read in grab_file_name()
• Fixing bsc#1201132 VUL-1: CVE-2022-2264: vim: out of bounds read in inc()
• Fixing bsc#1201133 VUL-1: CVE-2022-2284: vim: out of bounds read in utfc_ptr2len()
• Fixing bsc#1201134 VUL-1: CVE-2022-2285: vim: negative size passed to memmove() due to integer overflow
• Fixing bsc#1201135 VUL-1: CVE-2022-2286: vim: out of bounds read in ins_bytes()
• Fixing bsc#1201136 VUL-1: CVE-2022-2287: vim: out of bounds read in suggest_trie_walk()
• Fixing bsc#1201150 VUL-1: CVE-2022-2231: vim: null pointer dereference skipwhite()
• Fixing bsc#1201151 VUL-1: CVE-2022-2210: vim: out of bounds read in ml_append_int()
• Fixing bsc#1201152 VUL-1: CVE-2022-2208: vim: null pointer dereference in diff_check()
• Fixing bsc#1201153 VUL-1: CVE-2022-2207: vim: out of bounds read in ins_bs()
• Fixing bsc#1201154 VUL-1:…

It was discovered that vim incorrectly handled parsing of filenames in its search functionality. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. This issue only affected Ubuntu 21.10. (CVE-2021-3973)

It was discovered that vim incorrectly handled memory when opening and searching the contents of certain files. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. This issue only affected Ubuntu 20.04 LTS and Ubuntu 21.10. (CVE-2021-3974)

It was discovered that vim incorrectly handled memory when opening and editing certain files. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-3984)

It was discovered that vim incorrectly handled memory when opening and editing certain files. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-4019)

It was discovered that vim incorrectly handled memory when opening and editing certain files. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges.(CVE-2021-4069)

It was discovered that Vim incorrectly handled parsing of filenames in its search functionality. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. (CVE-2021-3973)

It was discovered that Vim incorrectly handled memory when opening and searching the contents of certain files. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-3974)

It was discovered that Vim incorrectly handled memory when opening and editing certain files. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-3984, CVE-2021-4019, CVE-2021-4069)

It was discovered that Vim was using freed memory when dealing with regular expressions inside a visual selection. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-4192)

It was discovered that Vim was incorrectly performing read and write operations when in visual block mode, going beyond the end of a line and causing a heap buffer overflow. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2022-0261, CVE-2022-0318)

It was discovered that Vim was using freed memory when dealing with regular expressions through its old regular expression engine. If a user were tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2022-1154)

It was discovered that vim incorrectly handled parsing of filenames in its search functionality. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service. (CVE-2021-3973)

It was discovered that vim incorrectly handled memory when opening and searching the contents of certain files. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-3974)

It was discovered that vim incorrectly handled memory when opening and editing certain files. If a user was tricked into opening a specially crafted file, an attacker could crash the application, leading to a denial of service, or possibly achieve code execution with user privileges. (CVE-2021-3984, CVE-2021-4019, CVE-2021-4069)