In late 2021, six vulnerabilities I reported in Vim were assigned CVEs.

4 were classified as heap-based buffer overflows, 1 as use of an uninitialized variable, and 1 as a use-after-free. Vim fixed the issues in patches released between October 25 and November 19. The final CVE record, CVE-2021-3984, was published on December 1, 2021.

CVE-2021-3984 marked valid on Huntr

The issues affected several parts of the editor, including scrolling, line handling, spell suggestions, window commands, regular-expression processing, and C indentation.

Vim maintainer Bram Moolenaar authored all six upstream fixes.

I submitted all 6 reports through the Huntr platform.

Huntr status for CVE-2021-3984 showing the report as fixed, with Cem as the finder and Bram Moolenaar as the fixer

Vulnerabilities

The issues are listed below in the order their Vim patches were released.

  1. CVE-2021-3903 (Huntr) - Heap-based buffer overflow. Reported October 25 and fixed in Vim 8.2.3564 the same day.
  2. CVE-2021-3927 (Huntr) - Heap-based buffer overflow. Reported October 26 and fixed in Vim 8.2.3581 on November 4.
  3. CVE-2021-3928 (Huntr) - Use of an uninitialized variable. Reported October 29 and fixed in Vim 8.2.3582 on November 4.
  4. CVE-2021-3973 (Huntr) - Heap-based buffer overflow. Reported November 12 and fixed in Vim 8.2.3611 on November 17.
  5. CVE-2021-3974 (Huntr) - Use-after-free. Reported October 25 and fixed in Vim 8.2.3612 on November 17.
  6. CVE-2021-3984 (Huntr) - Heap-based buffer overflow. Reported November 18 and fixed in Vim 8.2.3625 on November 19.

The linked GitHub pages preserve my original reports, including the minimized proofs of concept, reproduction steps, and sanitizer output.

Bram Moolenaar confirming the CVE-2021-3984 fix

In Memory of Bram Moolenaar

Bram Moolenaar (1961-2023) made Vim part of everyday life for generations of developers. Rest in peace.

The CVEs above also offered a less conventional way to exit Vim.

References