Use after free in utf_ptr2char in vim/vim

Vulnerability

A use-after-free vulnerability exists in the utf_ptr2char function of Vim versions prior to 8.2.4646. The flaw occurs when the regexp engine accesses a buffer line after it has been freed. The commit [1] shows a fix in regmatch() that saves the cursor column position before calling getmark_buf(), then re-fetches the line and adjusts the input pointer afterward, preventing use of freed memory. The vulnerable code path is reachable via the \%'m and \%#=1\%'m patterns in substitutions, as demonstrated in the test added with the patch [1].

Exploitation

An attacker can trigger the use-after-free by crafting a file or input containing a substitution pattern that uses markers, e.g., s/\%') (with the new engine) or s/\%#=1\%') (with the old engine). When Vim executes the substitution, the regex engine calls getmark_buf() which may free the underlying buffer line. Subsequent access to rex.line without re-fetching leads to use of freed memory. No authentication or special privileges are required; the victim only needs to open the crafted file or apply the substitution in Vim.

Impact

Successful exploitation could lead to a crash of the Vim editor or potential arbitrary code execution in the context of the Vim process. The impact is primarily denial of service, but the nature of use-after-free vulnerabilities can allow an attacker to control execution flow if they can influence the freed memory content.

Mitigation

The vulnerability is fixed in Vim version 8.2.4646 and later [1]. Users should upgrade Vim to at least 8.2.4646 or any subsequent version. Distributions such as Gentoo have provided updated packages (>=9.0.0060) as part of a broader security update [4]. No workaround is available [4].