CVE-2024-43374

一、漏洞信息
 漏洞编号：[CVE-2024-43374](https://nvd.nist.gov/vuln/detail/CVE-2024-43374)
 漏洞归属组件：[vim](https://gitee.com/src-openeuler/vim)
 漏洞归属的版本：8.2,9.0,9.0.2092
 CVSS V3.0分值：
  BaseScore：4.5 Medium
  Vector：CVSS：3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
 漏洞简述：
  The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers `Buf*` autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.
 漏洞公开时间：2024-08-16 10:15:17
 漏洞创建时间：2024-08-16 18:46:26
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-43374
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8 |  |
| security-advisories.github.com | https://github.com/vim/vim/security/advisories/GHSA-2w8m-443v-cgvw |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-43374 | https://bugzilla.suse.com/show_bug.cgi?id=1229238 |
| suse_bugzilla | https://seclists.org/oss-sec/2024/q3/205 | https://bugzilla.suse.com/show_bug.cgi?id=1229238 |
| suse_bugzilla | https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8 | https://bugzilla.suse.com/show_bug.cgi?id=1229238 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2024-43374 | https://bugzilla.suse.com/show_bug.cgi?id=1229238 |
| suse_bugzilla | https://github.com/vim/vim/security/advisories/GHSA-2w8m-443v-cgvw | https://bugzilla.suse.com/show_bug.cgi?id=1229238 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-43374 |
| trousers | https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8 | https://seclists.org/oss-sec/2024/q3/205 |
| trousers | https://github.com/vim/vim/security/GHSA-2w8m-443v-cgvw | https://seclists.org/oss-sec/2024/q3/205 |
| amazon_linux_explore | https://access.redhat.com/security/cve/CVE-2024-43374 | https://explore.alas.aws.amazon.com/CVE-2024-43374.html |
| amazon_linux_explore | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43374 | https://explore.alas.aws.amazon.com/CVE-2024-43374.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8 |  | security-advisories.github.com |
|  |  | https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8 |  | suse_bugzilla |
|  |  | https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8 |  | trousers |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
        vim组件在处理参数列表时存在使用释放后的内存错误。将新文件添加到参数列表时，会触发 Buf* 自动命令。如果在这样的自动命令中关闭刚刚打开的缓冲区（包括显示该缓冲区的窗口），则会导致释放包含对我们实际正在修改的参数列表的引用的窗口结构。自动命令完成后，对窗口和参数列表的引用将不再有效，因此会导致使用释放后内存。这可能导致程序崩溃、访问意外值等错误。   
 openEuler评分：
  4.5
 Vector：CVSS：3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
 受影响版本排查(受影响/不受影响)：
  1.master(9.0.2092):受影响
2.openEuler-20.03-LTS-SP4(9.0):受影响
3.openEuler-22.03-LTS-SP1(9.0):受影响
4.openEuler-22.03-LTS-SP3(9.0):受影响
5.openEuler-22.03-LTS-SP4(9.0):受影响
6.openEuler-24.03-LTS(9.0.2092):受影响
7.openEuler-24.03-LTS-Next(9.0.2092):受影响

修复是否涉及abi变化(是/否)：
  1.master(9.0.2092):否
2.openEuler-20.03-LTS-SP4(9.0):否
3.openEuler-22.03-LTS-SP1(9.0):否
4.openEuler-22.03-LTS-SP3(9.0):否
5.openEuler-22.03-LTS-SP4(9.0):否
6.openEuler-24.03-LTS(9.0.2092):否
7.openEuler-24.03-LTS-Next(9.0.2092):否

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2026

src-openEuler/vim
Closed

Content Risk Flag

Comments (10)

src-openEuler/vimClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-43374

Comments (10)

Search

src-openEuler/vim
Closed