Unverified Ownership in Vim - #VU162558

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary shell commands in the context of the user running Vim or impersonate the Vim server to clients.

The vulnerability exists due to unverified ownership and permissions of an existing socket directory in socketserver_get_path() when creating a server socket in a shared directory such as /tmp. A remote attacker can pre-create the victim's socket directory to connect to the socket and submit arbitrary Vim expressions when the victim's umask permits access, or replace the socket to impersonate the server to clients.

Exploitation requires a Vim build with the +socketserver feature operating as a server.

Affected software

Remediation

External References

• https://github.com/vim/vim/security/advisories/GHSA-p99j-mfjp-r4cg
• https://github.com/vim/vim/commit/a448e0c6bc459d7dbeab581bcb76a0d

Related Security Bulletins

• Unverified Ownership in Vim