Out-of-bounds write in Vim - CVE-2022-2288

Vulnerability identifier: #VU65406

CSH Severity: Low

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2288

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to a boundary error in parse_command_modifiers() function at ex_docmd.c:3123. A remote attacker can create a specially crafted file, trick the victim into opening it using the affected software, trigger out-of-bounds write and execute arbitrary code on the target system.

Vim
Gentoo Linux
Amazon Linux AMI
Fedora
vim
app-editors/gvim
app-editors/vim
app-editors/vim-core

Install updates from vendor's website.

Vim - update to 9.0.0025
vim - addressed in versions 9.0.049-1.fc35, 9.0.049-1.fc36
app-editors/gvim - addressed in versions 9.0.0060, 9.0.1157
app-editors/vim - addressed in versions 9.0.0060, 9.0.1157
app-editors/vim-core - addressed in versions 9.0.0060, 9.0.1157
vim - addressed in versions 9.0.475-1.1, 9.0.1160-1.1

• https://huntr.dev/bounties/a71bdcb7-4e9b-4650-ab6a-fe8e3e9852ad
• https://github.com/vim/vim/commit/c6fdb15d423df22e1776844811d082322475e48a
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/

• Multiple vulnerabilities in Vim
• Gentoo update for Vim, gVim
• Amazon Linux AMI update for vim
• Gentoo update for Vim, gVim
• Amazon Linux AMI update for vim
• Fedora 36 update for vim
• Fedora 35 update for vim