NULL Pointer Dereference in vim/vim

Vulnerability

A null pointer dereference vulnerability exists in the vgetorpeek function of Vim's input processing. The issue occurs when handling a nested :open command while in command-line mode, where get_cmdline_info()->cmdbuff can be NULL. The vulnerability affects Vim versions prior to 9.0.1392. [1]

Exploitation

An attacker can exploit this vulnerability by crafting a file or command sequence that triggers a nested :open command during command-line editing. The attacker does not require authentication if they can trick a user into executing the malicious commands. The specific sequence involves entering command-line mode and executing :open within a context where the command buffer is not initialized. [1]

Impact

Successful exploitation causes a null pointer dereference leading to a segmentation fault, resulting in a denial of service. There is no evidence of code execution or information disclosure. The crash terminates the Vim process. [1]

Mitigation

The vulnerability is fixed in Vim version 9.0.1392, released on 2023-03-07. Users should update to this version or later. For systems where updating is not immediately possible, avoid processing untrusted commands or opening files that may contain malicious :open sequences. [1]