Use After Free in vim/vim

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux10.0
• debian debian linux9.0
• fedoraproject fedora34
• fedoraproject fedora35
• vim vimbefore 8.2.4253

Versions reported by the vendor

Affected version ranges reported by the assigning authority (@huntrdev). Independent of NVD's CPE analysis and usually ahead of it.

• vim vim/vim

  • unspecified and later · before 8.2affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2008-2712Vim 7.1.314, 6.4, and other versions allows user-assisted remote attackers to execute arbitrary commands via Vim scripts that do not properl
  42Plan
• CVE-2022-0318Heap-based Buffer Overflow in vim/vim
  40Plan
• CVE-2019-12735getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command i
  40Plan
• CVE-2017-6350An integer overflow at an unserialize_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate
  40Plan
• CVE-2017-6349An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate valu
  40Plan
• CVE-2017-5953vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overf
  40Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.