The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers Buf*
autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.
{ "vanir_signatures": [ { "signature_type": "Function", "deprecated": false, "digest": { "length": 1568.0, "function_hash": "23268502640491223538498109215581903914" }, "id": "CVE-2024-43374-06a44c42", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "function": "term_after_channel_closed", "file": "src/terminal.c" } }, { "signature_type": "Line", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "27676801470141722002695605065659309826", "274136091290085859712803694776840632648", "95187214763660831100839881044961502192", "20580097290675622387978236348495682961" ] }, "id": "CVE-2024-43374-0e15d81b", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "file": "src/structs.h" } }, { "signature_type": "Function", "deprecated": false, "digest": { "length": 482.0, "function_hash": "302442309805326173830655186755897424593" }, "id": "CVE-2024-43374-3840ded4", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "function": "alist_add", "file": "src/arglist.c" } }, { "signature_type": "Function", "deprecated": false, "digest": { "length": 11352.0, "function_hash": "285287504911461864651926552286475341993" }, "id": "CVE-2024-43374-45b05209", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "function": "do_ecmd", "file": "src/ex_cmds.c" } }, { "signature_type": "Function", "deprecated": false, "digest": { "length": 897.0, "function_hash": "250565783122775206324344534398706783448" }, "id": "CVE-2024-43374-5903075f", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "function": "alist_add_list", "file": "src/arglist.c" } }, { "signature_type": "Line", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "139081044701802438687807380237306825472", "16130154999049864527795482925487278256", "153087190605048840787127495415886693822", "171036842537978881902924749312976932045", "686675886637406598219423700442462967", "250027109555501571559337129236562531916", "310728658493157355722821322064544141581", "71978820375907382561308353453941311", "156104722742999423990427469219761503486", "292091505100313022326368415325830062417", "205829687884037237728893212719428306021", "260172004496452205671711920308164312398", "105404537272627456607336257786273529074", "70436147176586748500315612534403603665", "204268089123793975570035237560967789579", "298563925794507509042161880191579944126", "164862539038146417078391297821024464697", "211852102870019407433849102061427575711", "335759790279175732639249370752191763706", "294406754815128678480472447700628445938", "227788481041817628483178138494957156953", "305061779242106239034181510532887414742", "287054698987305275740992391859460028008", "211400287380998839621003282474333039467", "326365843427594379601815091604074657650", "27642168738304933664663102500150789430", "312105946101274395928293228379351364035", "151833837018723133489981310060691716594", "139637810617450696512808477993524316478", "177897116197129886839199303953243227360", "237977761971690276405438034895910399118", "139456919999779789311726032886907282969", "326365843427594379601815091604074657650", "27642168738304933664663102500150789430", "72002328512201157316706733369753385157", "329052807157358588382514372331528845999", "228867019531280229868263390986302016148", "21516023801586995595538955876844763189", "66638559985534446474523043406815337257", "253476756149469924704447165285154752471" ] }, "id": "CVE-2024-43374-5bd177a6", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "file": "src/window.c" } }, { "signature_type": "Line", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "166113013522332390164509407920996504008", "301169412098089150488030871966243135022", "133680302274963891266110956355954638887", "89915508867405449154757850911994646441", "191860546124444498264712736010846093350", "50317516310201420555062558468939456380", "1507403679155778484379546249128128857", "140198752257304987069431048744214496259" ] }, "id": "CVE-2024-43374-6bd167c8", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "file": "src/buffer.c" } }, { "signature_type": "Function", "deprecated": false, "digest": { "length": 2825.0, "function_hash": "80700937113803823485584421007485740200" }, "id": "CVE-2024-43374-7634fc8e", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "function": "ex_buffer_all", "file": "src/buffer.c" } }, { "signature_type": "Line", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "146200493773228420153804765641940418619", "303350083516222927057725054872132373757", "96824593211526899356549637190609859623", "38412983457431178554171818788384542345" ] }, "id": "CVE-2024-43374-829969d7", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "file": "src/version.c" } }, { "signature_type": "Function", "deprecated": false, "digest": { "length": 602.0, "function_hash": "222726146019689791197391592517614973164" }, "id": "CVE-2024-43374-920d27cf", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "function": "win_close_buffer", "file": "src/window.c" } }, { "signature_type": "Line", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "217598491622927398771921855388202265925", "124569386884548732916779532465051937687", "339657063770994482971889086529869986596", "230823516118869833593541703572669542830", "105501207107844815148724044062299482165", "199711488793540980257345154942177886661", "171750511103518499748861575606239483549" ] }, "id": "CVE-2024-43374-9707704d", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "file": "src/terminal.c" } }, { "signature_type": "Function", "deprecated": false, "digest": { "length": 866.0, "function_hash": "180508128104436460063574824735757745158" }, "id": "CVE-2024-43374-9f80942c", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "function": "close_windows", "file": "src/window.c" } }, { "signature_type": "Function", "deprecated": false, "digest": { "length": 4075.0, "function_hash": "217932166629076209668564951052780954626" }, "id": "CVE-2024-43374-ae7f7b74", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "function": "win_close", "file": "src/window.c" } }, { "signature_type": "Line", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "34511382149172304150241495636521779265", "104478917301252940802365409046449350529", "52673352943668731536035361860334724266", "112117926939457956460049113854128605008", "42259245746687173763350634398472693816", "134583666138628112531235338870680780443", "252246393303873081644984867061945239066", "261325307918153196850613099792180643531" ] }, "id": "CVE-2024-43374-cbde2f2c", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "file": "src/ex_cmds.c" } }, { "signature_type": "Function", "deprecated": false, "digest": { "length": 1343.0, "function_hash": "275214950971697618483013450148670419708" }, "id": "CVE-2024-43374-d043281c", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "function": "win_close_othertab", "file": "src/window.c" } }, { "signature_type": "Line", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "88135516828833340299805919438817870289", "99056319061021921697312839754809236877", "247106147661198956955142943555444752367", "44626685314551541299339776096986071470", "150286781316637155035127566413561136702", "275599168783202500076615353175672851047", "170866462787792110091741149843038009397", "20969955342689790979405278713881526951", "147326731723099265365867460173325397860", "232882941929483429700724211251947689405", "279776651257948467165511183635800798678", "71634241392564864013694106155459873148", "209823752459720161534841839955220146144", "306748141608099665136169193471809176217", "234167651035342926680595915050230142686", "302533169278117023454946675178625276568", "320828844111317150379942821683367348080", "45893730133554088775966331595261894351", "293654292483758350535499238630179441268" ] }, "id": "CVE-2024-43374-f589dbf3", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "file": "src/arglist.c" } }, { "signature_type": "Function", "deprecated": false, "digest": { "length": 5750.0, "function_hash": "217660663114029999773586032019335783970" }, "id": "CVE-2024-43374-faf14b0e", "source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8", "signature_version": "v1", "target": { "function": "do_buffer_ext", "file": "src/buffer.c" } } ] }