Heap-based Buffer Overflow in vim/vim

Vulnerability

CVE-2021-3984 is a heap-based buffer overflow in Vim's C-indenting functionality, specifically in the find_start_brace function. The flaw exists in Vim versions prior to 8.2.3625 and occurs when the editor processes a malformed C file that triggers an illegal memory access during indentation. The find_start_brace function, which is marked with a comment indicating it is problematic ("XXX"), had a bug where it could copy a pos_T structure beyond allocated memory, leading to a heap-based buffer overflow [1][2].

Exploitation

Exploitation requires an attacker to craft a malicious C source file that, when opened and subjected to Vim's C-indentation (for example, by using the = operator on a visual selection or by automatic indentation), triggers the overflow in find_start_brace. A proof-of-concept test in the patch [2] shows that the sequence of operations new, norm R/*, norm o0{, norm o//, norm V{= is sufficient to reproduce the issue. No special privileges beyond normal file opening are required; the attacker only needs to convince a user to open the crafted file in Vim [1][2].

Impact

Successful exploitation can lead to a heap-based buffer overflow, which may result in a crash (denial of service) or potentially arbitrary code execution in the context of the Vim process. The vulnerability is classified as a heap-based buffer overflow, and given that Vim is widely used for editing configuration files and source code, an attacker could leverage this to compromise a system if Vim is run with elevated privileges [1][4].

Mitigation

The fix was implemented in Vim patch 8.2.3625, released on or before September 30, 2021 [2]. Users should upgrade to Vim version 8.2.3625 or later. Gentoo has released a GLSA (GLSA 202208-32) advising users to upgrade to Vim 9.0.0060 or later [4]. No workaround is known, as the vulnerability is triggered by the built-in C-indentation logic that cannot be easily disabled without losing functionality [4].