Out-of-bounds Write in vim/vim

Vulnerability

The vulnerability is an out-of-bounds write in the diff_mark_adjust_tp function within Vim's source code, specifically in the handling of diff block adjustments when lines are deleted. The variable off was not always initialized before use, leading to an out-of-bounds write. This affects Vim versions prior to patch 8.2.5164 (commit c101abff4c6756db4f5e740fde289decb9452efa) [1]. The code path is reachable when using Vim's diff mode (e.g., vimdiff) and performing certain buffer manipulations that trigger the adjustment of diff marks.

Exploitation

An attacker would need to trick a user into opening a specially crafted file in Vim's diff mode or cause the user to perform specific buffer operations that trigger the vulnerable code path. No authentication is required beyond local access to Vim. The attacker must craft a file or sequence of edits that cause the diff algorithm to adjust marks in a way that the uninitialized off variable leads to an out-of-bounds write. The exact steps are not publicly detailed, but the commit test case (Test_diff_manipulations) shows a sequence of commands that reproduce the issue [1].

Impact

Successful exploitation could result in memory corruption, potentially leading to a denial of service (crash) or arbitrary code execution. The out-of-bounds write occurs in heap memory, and the impact depends on the memory layout. The vulnerability is classified as an out-of-bounds write, which can be leveraged for more severe attacks if combined with other techniques.

Mitigation

The fix was released in Vim patch 8.2.5164, available in the referenced commit [1]. Users should upgrade to Vim version 8.2.5164 or later. For distributions, the Gentoo GLSA [4] recommends upgrading to >=app-editors/vim-9.0.0060. No workaround is known; users should apply the patch as soon as possible.