EulerOS 2.0 SP10 : vim (EulerOS-SA-2024-2898)

medium Nessus Plugin ID 210682

Synopsis

The remote EulerOS host is missing multiple security updates.

Description

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

Vim is an open source command line text editor.double-free in dialog_changed() in Vim v9.1.0648.When abandoning a buffer, Vim may ask the user what to do with the modified buffer.If the user wants the changed buffer to be saved, Vim may create a new Untitled file, if the buffer did not have a name yet.However, when setting the buffer name to Unnamed, Vim will falsely free a pointer twice, leading to a double-free and possibly later to a heap-use-after-free, which can lead to a crash.The issue has been fixed as of Vim patch v9.1.0648.(CVE-2024-41965)

Vim is an open source command line text editor.Vim v9.1.0647 has double free in src/alloc.c:616.When closing a window, the corresponding tagstack data will be cleared and freed.However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception.Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim.The issue has been fixed as of Vim patch v9.1.0647(CVE-2024-41957)

The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling.When adding a new file to the argument list, this triggers `Buf*` autocommands.If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying.Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free.Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim.The issue has been fixed as of Vim patch v9.1.0678.(CVE-2024-43374)

Vim is an improved version of the unix vi text editor.When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tb_off position within the typebuf variable to point outside of the valid buffer size, which can then later lead to a heap-buffer overflow in e.g.ins_typebuf().Therefore, when flushing the typeahead buffer, check if there is enough space left before advancing the off position.If not, fall back to flush current typebuf contents.It's not quite clear yet, what can lead to this situation.It seems to happen when error messages occur (which will cause Vim to flush the typeahead buffer) in comnination with several long mappgins and so it may eventually move the off position out of a valid buffer size.Impact is low since it is not easily reproducible and requires to have several mappings active and run into some error condition.But when this happens, this will cause a crash.The issue has been fixed as of Vim patch v9.1.0697.Users are advised to upgrade.There are no known workarounds for this issue.(CVE-2024-43802)

Tenable has extracted the preceding description block directly from the EulerOS vim security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected vim packages.

Plugin Details

Severity: Medium

ID: 210682

File Name: EulerOS_SA-2024-2898.nasl

Version: 1.1

Type: local

Family: Huawei Local Security Checks

Published: 11/8/2024

Updated: 11/8/2024

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2024-41957

CVSS v3

Risk Factor: Medium

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:huawei:euleros:2.0, p-cpe:/a:huawei:euleros:vim-common, p-cpe:/a:huawei:euleros:vim-enhanced, p-cpe:/a:huawei:euleros:vim-filesystem, p-cpe:/a:huawei:euleros:vim-minimal

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/sp

Excluded KB Items: Host/EulerOS/uvp_version

Exploit Ease: No known exploits are available

Patch Publication Date: 11/8/2024

Vulnerability Publication Date: 8/1/2024

Reference Information

CVE: CVE-2024-41957, CVE-2024-41965, CVE-2024-43374, CVE-2024-43802

Detections

Analytics