overflow in shift_line in vim

Vulnerability

A integer overflow vulnerability exists in Vim's shift_line() function when shifting lines in operator-pending mode. If a user provides a very large value, the computation count += (long long)sw_val * (long long)amount can overflow the signed integer count, causing undefined behavior. This affects Vim versions prior to 9.0.2112. The issue was introduced in an unknown earlier version and is addressed in commit 6bf131888 [2].

Exploitation

Exploitation requires user interaction: a user must open a file in Vim and trigger a shift operation (e.g., >, <) in operator-pending mode with a very large count value. An attacker cannot trigger this remotely without tricking the user into executing a crafted command or opening a malicious file that induces the overflow. The race window is negligible, and no special privileges are needed beyond normal file editing [1].

Impact

Successful exploitation may cause a crash (denial of service). The impact is low, as a crash may not occur in all situations, and the attacker does not gain code execution, privilege escalation, or information disclosure. The vulnerability does not lead to reading or writing files or executing arbitrary commands [1].

Mitigation

Upgrade to Vim version 9.0.2112 or later, which contains the fix from commit 6bf131888 [1][2]. No workarounds are available; users must apply the patch or update their package. Fedora packages have been updated accordingly [3][4].