vim up to 9.1.696 ins_typebuf heap-based overflow

Summaryinfo

A vulnerability categorized as critical has been discovered in vim up to 9.1.696. The affected element is the function ins_typebuf. Such manipulation of the argument typebuf leads to heap-based overflow. This vulnerability is traded as CVE-2024-43802. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in vim up to 9.1.696 and classified as critical. Affected by this issue is the function ins_typebuf. The manipulation of the argument typebuf with an unknown input leads to a heap-based overflow vulnerability. Using CWE to declare the problem leads to CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). Impacted is confidentiality, integrity, and availability. CVE summarizes:

Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g. ins_typebuf(). Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position. If not, fall back to flush current typebuf contents. It's not quite clear yet, what can lead to this situation. It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size. Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition. But when this happens, this will cause a crash. The issue has been fixed as of Vim patch v9.1.0697. Users are advised to upgrade. There are no known workarounds for this issue.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-43802 since 08/16/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 209312 (CBL Mariner 2.0 Security Update: vim (CVE-2024-43802)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 9.1.0697 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (209312) and CERT Bund (WID-SEC-2025-1439). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• SUSE Linux
• Dell Secure Connect Gateway

Productinfo

Type

• Word Processing Software

Name

• vim

Version

• 9.1.696

License

• open-source

Website

• Product: https://github.com/vim/vim/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion