Bug 1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute
Summary: VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute
Status: RESOLVED FIXED
Alias: CVE-2023-48706
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Zoltan Balogh
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/385928/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-48706:3.6:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-11-23 09:15 UTC by SMASH SMASH
Modified: 2024-05-24 10:37 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description SMASH SMASH 2023-11-23 09:15:05 UTC
When executing a :s command for the very first time and using a sub-replace-special atom inside the substitution part, it is possible that the recursive :s call causes free-ing of memory which may later then be accessed by the initial :s comamnd.

Impact is low since the user must intentionally execute the payload and the whole process is a bit tricky to do (since it seems to work only reliably for the very first :s command). It may also cause a crash of Vim.

The Vim project would like to thank github user gandalf4a for reporting this issue which is now fixed in Vim patch 9.0.2121.

References:
https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q
Comment 1 Gabriele Sonnu 2023-11-23 09:18:19 UTC
Tracking as affected:

 - SUSE:ALP:Source:Standard:1.0/vim
 - SUSE:SLE-12:Update/vim
 - SUSE:SLE-15-SP5:Update/vim
 - SUSE:SLE-15:Update/vim
 - openSUSE:Factory/vim

Upstream fix:

https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf860f3c26f57bb
Comment 4 Zoltan Balogh 2024-02-29 11:07:40 UTC
The next upcoming maintenance update will have the fix.
Comment 10 Maintenance Automation 2024-03-06 20:30:08 UTC
SUSE-SU-2024:0783-1: An update that solves 10 vulnerabilities can now be installed.

Category: security (important)
Bug References: 1215005, 1217316, 1217320, 1217321, 1217324, 1217326, 1217329, 1217330, 1217432, 1219581
CVE References: CVE-2023-4750, CVE-2023-48231, CVE-2023-48232, CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237, CVE-2023-48706, CVE-2024-22667
Sources used:
SUSE Linux Enterprise High Performance Computing 12 SP5 (src): vim-9.1.0111-17.29.1
SUSE Linux Enterprise Server 12 SP5 (src): vim-9.1.0111-17.29.1
SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): vim-9.1.0111-17.29.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 11 Maintenance Automation 2024-03-13 16:30:16 UTC
SUSE-SU-2024:0871-1: An update that solves 10 vulnerabilities can now be installed.

Category: security (important)
Bug References: 1215005, 1217316, 1217320, 1217321, 1217324, 1217326, 1217329, 1217330, 1217432, 1219581
CVE References: CVE-2023-4750, CVE-2023-48231, CVE-2023-48232, CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237, CVE-2023-48706, CVE-2024-22667
Sources used:
openSUSE Leap Micro 5.3 (src): vim-9.1.0111-150000.5.60.1
openSUSE Leap Micro 5.4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro for Rancher 5.3 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro 5.3 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro for Rancher 5.4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro 5.4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Desktop 15 SP4 LTSS 15-SP4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Server for SAP Applications 15 SP4 (src): vim-9.1.0111-150000.5.60.1
SUSE Manager Proxy 4.3 (src): vim-9.1.0111-150000.5.60.1
SUSE Manager Retail Branch Server 4.3 (src): vim-9.1.0111-150000.5.60.1
SUSE Manager Server 4.3 (src): vim-9.1.0111-150000.5.60.1
SUSE Enterprise Storage 7.1 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro 5.1 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro 5.2 (src): vim-9.1.0111-150000.5.60.1
SUSE Linux Enterprise Micro for Rancher 5.2 (src): vim-9.1.0111-150000.5.60.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Maintenance Automation 2024-04-15 16:30:09 UTC
SUSE-SU-2024:1287-1: An update that solves 10 vulnerabilities can now be installed.

Category: security (important)
Bug References: 1215005, 1217316, 1217320, 1217321, 1217324, 1217326, 1217329, 1217330, 1217432, 1219581
CVE References: CVE-2023-4750, CVE-2023-48231, CVE-2023-48232, CVE-2023-48233, CVE-2023-48234, CVE-2023-48235, CVE-2023-48236, CVE-2023-48237, CVE-2023-48706, CVE-2024-22667
Maintenance Incident: [SUSE:Maintenance:32818](https://smelt.suse.de/incident/32818/)
Sources used:
openSUSE Leap 15.5 (src):
 vim-9.1.0111-150500.20.9.1
SUSE Linux Enterprise Micro 5.5 (src):
 vim-9.1.0111-150500.20.9.1
Basesystem Module 15-SP5 (src):
 vim-9.1.0111-150500.20.9.1
Desktop Applications Module 15-SP5 (src):
 vim-9.1.0111-150500.20.9.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Alexander Bergmann 2024-05-24 10:37:41 UTC
Released. Closing bug.