#VU68963 Use-after-free in Vim - CVE-2022-3352


Vulnerability identifier: #VU68963

Vulnerability risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-3352

CWE-ID: CWE-416

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Vim
Client/Desktop applications / Software for system administration

Vendor: Vim.org

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when handling files within the did_set_string_option() function in optionstr.c. A remote attacker can trick the victim to open a specially crafted file, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Vim: 9.0.0000, 9.0.0001, 9.0.0002, 9.0.0003, 9.0.0004, 9.0.0005, 9.0.0006, 9.0.0007, 9.0.0008, 9.0.0009, 9.0.0010, 9.0.0011, 9.0.0012, 9.0.0013, 9.0.0014, 9.0.0015, 9.0.0016, 9.0.0017, 9.0.0018, 9.0.0019, 9.0.0020, 9.0.0021, 9.0.0022, 9.0.0023, 9.0.0024, 9.0.0025, 9.0.0026, 9.0.0027, 9.0.0028, 9.0.0029, 9.0.0030, 9.0.0031, 9.0.0032, 9.0.0033, 9.0.0034, 9.0.0035, 9.0.0036, 9.0.0037, 9.0.0038, 9.0.0039, 9.0.0040, 9.0.0041, 9.0.0042, 9.0.0043, 9.0.0044, 9.0.0045, 9.0.0046, 9.0.0047, 9.0.0048, 9.0.0049, 9.0.0050, 9.0.0051, 9.0.0052, 9.0.0053, 9.0.0054, 9.0.0055, 9.0.0056, 9.0.0057, 9.0.0058, 9.0.0059, 9.0.0060, 9.0.0061, 9.0.0062, 9.0.0063, 9.0.0064, 9.0.0065, 9.0.0066, 9.0.0067, 9.0.0068, 9.0.0069, 9.0.0070, 9.0.0071, 9.0.0072, 9.0.0073, 9.0.0074, 9.0.0075, 9.0.0076, 9.0.0077, 9.0.0078, 9.0.0079, 9.0.0080, 9.0.0081, 9.0.0082, 9.0.0083, 9.0.0084, 9.0.0085, 9.0.0086, 9.0.0087, 9.0.0088, 9.0.0089, 9.0.0090, 9.0.0091, 9.0.0092, 9.0.0093, 9.0.0094, 9.0.0095, 9.0.0096, 9.0.0097, 9.0.0098, 9.0.0099, 9.0.0100, 9.0.0101, 9.0.0102, 9.0.0103, 9.0.0104, 9.0.0105, 9.0.0106, 9.0.0107, 9.0.0108, 9.0.0109, 9.0.0110, 9.0.0111, 9.0.0112, 9.0.0113, 9.0.0114, 9.0.0115, 9.0.0116, 9.0.0117, 9.0.0118, 9.0.0119, 9.0.0120, 9.0.0121, 9.0.0122, 9.0.0123, 9.0.0124, 9.0.0125, 9.0.0126, 9.0.0127, 9.0.0128, 9.0.0129, 9.0.0130, 9.0.0131, 9.0.0132, 9.0.0133, 9.0.0134, 9.0.0135, 9.0.0136, 9.0.0137, 9.0.0138, 9.0.0139, 9.0.0140, 9.0.0141, 9.0.0142, 9.0.0143, 9.0.0144, 9.0.0145, 9.0.0146, 9.0.0147, 9.0.0148, 9.0.0151, 9.0.0152, 9.0.0153, 9.0.0154, 9.0.0155, 9.0.0156, 9.0.0157, 9.0.0158, 9.0.0159, 9.0.0160, 9.0.0161, 9.0.0162, 9.0.0163, 9.0.0164, 9.0.0165, 9.0.0166, 9.0.0167, 9.0.0168, 9.0.0169, 9.0.0170, 9.0.0171, 9.0.0172, 9.0.0173, 9.0.0174, 9.0.0175, 9.0.0176, 9.0.0177, 9.0.0178, 9.0.0179, 9.0.0180, 9.0.0181, 9.0.0182, 9.0.0183, 9.0.0184, 9.0.0185, 9.0.0186, 9.0.0187, 9.0.0188, 9.0.0189, 9.0.0190, 9.0.0191, 9.0.0192, 9.0.0193, 9.0.0194, 9.0.0195, 9.0.0196, 9.0.0197, 9.0.0198, 9.0.0199, 9.0.0200, 9.0.0201, 9.0.0202, 9.0.0203, 9.0.0204, 9.0.0205, 9.0.0206, 9.0.0207, 9.0.0208, 9.0.0209, 9.0.0210, 9.0.0211, 9.0.0212, 9.0.0213, 9.0.0214, 9.0.0215, 9.0.0216, 9.0.0217, 9.0.0218, 9.0.0219, 9.0.0220, 9.0.0221, 9.0.0222, 9.0.0223, 9.0.0224, 9.0.0225, 9.0.0226, 9.0.0227, 9.0.0228, 9.0.0229, 9.0.0230, 9.0.0231, 9.0.0232, 9.0.0233, 9.0.0234, 9.0.0235, 9.0.0236, 9.0.0237, 9.0.0238, 9.0.0239, 9.0.0240, 9.0.0241, 9.0.0242, 9.0.0243, 9.0.0244, 9.0.0245, 9.0.0246, 9.0.0247, 9.0.0248, 9.0.0249, 9.0.0250, 9.0.0251, 9.0.0252, 9.0.0253, 9.0.0254, 9.0.0255, 9.0.0256, 9.0.0257, 9.0.0258, 9.0.0259, 9.0.0260, 9.0.0261, 9.0.0262, 9.0.0263, 9.0.0264, 9.0.0265, 9.0.0266, 9.0.0267, 9.0.0268, 9.0.0269, 9.0.0270, 9.0.0271, 9.0.0272, 9.0.0275, 9.0.0276, 9.0.0277, 9.0.0278, 9.0.0279, 9.0.0280, 9.0.0281, 9.0.0282, 9.0.0283, 9.0.0284, 9.0.0285, 9.0.0286, 9.0.0287, 9.0.0288, 9.0.0289, 9.0.0290, 9.0.0291, 9.0.0292, 9.0.0293, 9.0.0303, 9.0.0304, 9.0.0305, 9.0.0306, 9.0.0307, 9.0.0308, 9.0.0309, 9.0.0310, 9.0.0311, 9.0.0312, 9.0.0313, 9.0.0314, 9.0.0316, 9.0.0317, 9.0.0318, 9.0.0319, 9.0.0320, 9.0.0321, 9.0.0322, 9.0.0323, 9.0.0324, 9.0.0325, 9.0.0326, 9.0.0328, 9.0.0329, 9.0.0330, 9.0.0331, 9.0.0332, 9.0.0333, 9.0.0334, 9.0.0335, 9.0.0336, 9.0.0337, 9.0.0338, 9.0.0339, 9.0.0340, 9.0.0341, 9.0.0342, 9.0.0343, 9.0.0344, 9.0.0345, 9.0.0346, 9.0.0347, 9.0.0348, 9.0.0349, 9.0.0350, 9.0.0351, 9.0.0352, 9.0.0353, 9.0.0354, 9.0.0355, 9.0.0356, 9.0.0357, 9.0.0358, 9.0.0359, 9.0.0360, 9.0.0361, 9.0.0362, 9.0.0363, 9.0.0364, 9.0.0365, 9.0.0366, 9.0.0367, 9.0.0368, 9.0.0369, 9.0.0370, 9.0.0371, 9.0.0372, 9.0.0373, 9.0.0374, 9.0.0375, 9.0.0376, 9.0.0377, 9.0.0378, 9.0.0379, 9.0.0380, 9.0.0381, 9.0.0382, 9.0.0383, 9.0.0384, 9.0.0385, 9.0.0386, 9.0.0387, 9.0.0388, 9.0.0389, 9.0.0390, 9.0.0391, 9.0.0392, 9.0.0393, 9.0.0394, 9.0.0395, 9.0.0396, 9.0.0397, 9.0.0398, 9.0.0399, 9.0.0400, 9.0.0401, 9.0.0402, 9.0.0403, 9.0.0404, 9.0.0405, 9.0.0406, 9.0.0407, 9.0.0408, 9.0.0409, 9.0.0410, 9.0.0411, 9.0.0412, 9.0.0413, 9.0.0414, 9.0.0415, 9.0.0416, 9.0.0417, 9.0.0418, 9.0.0419, 9.0.0420, 9.0.0421, 9.0.0422, 9.0.0423, 9.0.0424, 9.0.0425, 9.0.0426, 9.0.0427, 9.0.0428, 9.0.0429, 9.0.0430, 9.0.0431, 9.0.0432, 9.0.0433, 9.0.0434, 9.0.0435, 9.0.0436, 9.0.0437, 9.0.0438, 9.0.0439, 9.0.0440, 9.0.0441, 9.0.0442, 9.0.0443, 9.0.0444, 9.0.0445, 9.0.0446, 9.0.0447, 9.0.0448, 9.0.0449, 9.0.0450, 9.0.0451, 9.0.0452, 9.0.0453, 9.0.0454, 9.0.0455, 9.0.0456, 9.0.0457, 9.0.0458, 9.0.0459, 9.0.0460, 9.0.0461, 9.0.0462, 9.0.0463, 9.0.0464, 9.0.0465, 9.0.0466, 9.0.0467, 9.0.0468, 9.0.0469, 9.0.0470, 9.0.0471, 9.0.0472, 9.0.0473, 9.0.0474, 9.0.0475, 9.0.0476, 9.0.0477, 9.0.0478, 9.0.0479, 9.0.0480, 9.0.0481, 9.0.0482, 9.0.0483, 9.0.0484, 9.0.0485, 9.0.0486, 9.0.0487, 9.0.0488, 9.0.0489, 9.0.0490, 9.0.0491, 9.0.0492, 9.0.0493, 9.0.0494, 9.0.0495, 9.0.0496, 9.0.0497, 9.0.0498, 9.0.0499, 9.0.0500, 9.0.0501, 9.0.0502, 9.0.0503, 9.0.0504, 9.0.0505, 9.0.0506, 9.0.0507, 9.0.0508, 9.0.0509, 9.0.0510, 9.0.0511, 9.0.0512, 9.0.0513, 9.0.0514, 9.0.0515, 9.0.0516, 9.0.0517, 9.0.0518, 9.0.0519, 9.0.0520, 9.0.0521, 9.0.0522, 9.0.0523, 9.0.0524, 9.0.0525, 9.0.0526, 9.0.0527, 9.0.0528, 9.0.0529, 9.0.0530, 9.0.0531, 9.0.0532, 9.0.0533, 9.0.0534, 9.0.0535, 9.0.0536, 9.0.0537, 9.0.0538, 9.0.0539, 9.0.0540, 9.0.0541, 9.0.0542, 9.0.0543, 9.0.0544, 9.0.0545, 9.0.0546, 9.0.0547, 9.0.0548, 9.0.0549, 9.0.0550, 9.0.0551, 9.0.0552, 9.0.0553, 9.0.0554, 9.0.0555, 9.0.0556, 9.0.0557, 9.0.0558, 9.0.0559, 9.0.0560, 9.0.0561, 9.0.0562, 9.0.0563, 9.0.0564, 9.0.0565, 9.0.0566, 9.0.0567, 9.0.0568, 9.0.0569, 9.0.0570, 9.0.0571, 9.0.0572, 9.0.0573, 9.0.0574, 9.0.0575, 9.0.0576, 9.0.0577, 9.0.0578, 9.0.0579, 9.0.0580, 9.0.0581, 9.0.0582, 9.0.0583, 9.0.0584, 9.0.0585, 9.0.0586, 9.0.0587, 9.0.0588, 9.0.0589, 9.0.0590, 9.0.0591, 9.0.0592, 9.0.0593, 9.0.0594, 9.0.0595, 9.0.0596, 9.0.0597, 9.0.0598, 9.0.0599, 9.0.0600, 9.0.0601, 9.0.0602, 9.0.0603, 9.0.0604, 9.0.0605, 9.0.0606, 9.0.0607, 9.0.0608, 9.0.0609, 9.0.0610, 9.0.0611, 9.0.0612, 9.0.0613

External links
https://huntr.dev/bounties/d058f182-a49b-40c7-9234-43d4c5a29f60
https://github.com/vim/vim/commit/ef976323e770315b5fca544efb6b2faa25674d15
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data 
Amazon Linux AMI update for vim
VMware Tanzu products update for Vim
Ubuntu update for vim
Multiple vulnerabilities in Dell Data Protection Central
Multiple vulnerabilities in Dell EMC SRM and Dell EMC Storage Monitoring and Reporting (SMR)
Gentoo update for Vim, gVim
Multiple vulnerabilities in Dell EMC VxRail Appliance
Multiple vulnerabilities in Dell Cloud Tiering Appliance
Multiple vulnerabilities in Dell Secure Connect Gateway