Use After Free in vim/vim

Vulnerability

A use-after-free vulnerability exists in the do_window function of the Vim source code prior to version 8.2.4979 [1]. When Vim executes a command that triggers "#define" search (CTRL-W_#), the code in find_ident_under_cursor returns a pointer to a line buffer. If the original line is modified during subsequent operations, the pointer becomes invalid, and using it without copying leads to accessing freed memory [1]. This affects all Vim installations using the vulnerable versions.

Exploitation

An attacker requires the ability to open a specially crafted file in Vim and then cause the user to execute the "CTRL-W #" command (or another operation that invokes do_window with FIND_DEFINE) [1]. The attacker must also craft a file that triggers a line flush or modification after find_ident_under_cursor reads the identifier, such as through autocmds or specific buffer manipulations [1]. The provided test scenario uses setline to modify the buffer, sil norm o0 to add a line, and sil! norm CTRL-W # to trigger the search, which then accesses the freed pointer [1].

Impact

Successful exploitation allows an attacker to read or write freed heap memory by controlling the contents of the freed buffer [1]. The consequence can range from an application crash (denial of service) to potentially arbitrary code execution, depending on the heap state. The vulnerability has a CVSS score of 7.8 (High) and can compromise the confidentiality, integrity, and availability of the system [2][3].

Mitigation

Vim fixed this issue in patch 8.2.4979, released on 2022-05-19 [1]. Gentoo GLSA 202208-32 and 202305-16 recommend upgrading Vim to version 9.0.0060 or later (and subsequently 9.0.1157 for continued protection) [2][3]. Users should update their Vim installation to a patched version. There is no known workaround for unpatched versions [2][3].