Vim Out-of-bounds Read in Virtual Text via Crafted Undo File

Vulnerability Overview This vulnerability involves the virtual text feature for text properties in the Vim editor. The issue lies in the fact that a crafted undo file can declare a virtual text property with an offset beyond the range of the line's property data, leading to an out-of-bounds read when accessing the virtual text. This vulnerability was addressed in version 9.2.0679 by validating the offset and length of the virtual text to ensure that each property falls within the range of available property data, thereby preventing out-of-bounds reads. Affected Versions Affected versions: Versions prior to Vim 9.2.0679. Impact type: Out-of-bounds read. Potential risks: Could lead to information disclosure or program crashes. Remediation Fixed version: Vim 9.2.0679. Fix measure: Before converting the offset of the virtual text into a pointer, verify that its offset and length are within the range of available property data. POC Code The following is the POC code provided in the document: ```vim " src/testdir/textprop2.vim " A crafted undo file can restore a line whose virtual-text property declares an " out-of-range tp_text_offset. Turning that offset into a pointer and reading " the virtual text would read past the line buffer. Restore such a line and " force a consumer; reaching the asserts (no Abandon abort / crash) means the " offset is bounded. func Test_textprop_undo_bad_vtext_offset() CheckFeature persistent_undo " new call setline(1, ['AAAAAAAA', 'DECOYLINE']) let &ul = &ul call setline(1, 'BBBBBB') " undo step saves old line 1 = 'AAAAAAAA' undo Xpundo " One textprop_T for a virtual text (tp_id < 0) whose tp_text_offset " (&u0000000) points far past the 34-byte property data. The count (1) is " valid, so only the offset/length check can reject this. let prop = 0x00000000 let prop += 0x24000000 let prop += 0xFFFFFFFF let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x00000000 let prop += 0x000

Goal Reached Thanks to every supporter — we hit 100%!

Vim Out-of-bounds Read in Virtual Text via Crafted Undo File

More from this source