Heap-based Buffer Overflow in vim/vim

Vulnerability

CVE-2021-3875 is a heap-based buffer overflow vulnerability in the get_address() function of vim, specifically affecting versions prior to patch 8.2.3489 [2]. The flaw occurs when a search command (like / or ?) follows another address and the line number (lnum) is set to a value greater than the current buffer's line count (ml_line_count), which can result in an out-of-bounds write to heap memory [2]. The vulnerability is triggered by a specially crafted search range input, such as \%.v followed by 5/ and c as shown in the test case added in the fix [2].

Exploitation

To exploit this vulnerability, an attacker must convince a victim to open a malicious file or execute a crafted command sequence in vim. The attack requires no special privileges; any user with the ability to open a file in vim could trigger the bug. By crafting a file that contains a search pattern with an invalid line number range (e.g., lnum set beyond the buffer's line count), the attacker can cause the get_address() function to use an unsanitized line number, leading to heap corruption [2]. No user interaction beyond opening the file or executing the malicious command is required.

Impact

Successful exploitation of the heap-based buffer overflow can lead to a crash of vim or potentially to arbitrary code execution, depending on the heap layout and memory protections. The impact is primarily a denial of service (crash) or memory corruption. In environments where vim is used to edit privileged files (e.g., system configuration files with elevated privileges), exploitation could lead to privilege escalation, although this is not a typical scenario [1].

Mitigation

The vulnerability has been patched in vim version 8.2.3489, released on 2021-10-15 [2]. Users should upgrade to the latest stable release of vim (8.2.3489 or later). No workaround is available for unpatched versions. The vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog. Fedora and other distributions have announced patches via their package update channels [3][4].