CVE-2025-22134
개요
A flaw was found in Vim. Due to Vim not properly terminating visual mode, a heap buffer overflow condition may be triggered when a user switches buffers using the :all command. This issue may lead to unexpected behavior, such as an application crash or memory corruption.
내용
This vulnerability is rated Low for Red Hat products. The flaw in Vim requires a user to be in visual mode and then execute the :all command, which can lead to a heap buffer overflow. This specific user interaction limits the potential impact in typical Red Hat environments.
CVSS (Common Vulnerability Scoring System) 점수 세부 사항
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
다음의 CVSS 지표 및 점수는 예비 정보로 검토 대상입니다.
CVSS v3 점수 분석
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| 기본 점수 | 4.2 | 5.5 | N/A |
| 공격 벡터 | Local | Local | N/A |
| 공격 복잡성 | High | Low | N/A |
| 필요한 권한 | Low | None | N/A |
| 사용자 상호 작용 | Required | Required | N/A |
| 범위 | Unchanged | Unchanged | N/A |
| 기밀성 | Low | None | N/A |
| 무결성에 미치는 영향 | Low | None | N/A |
| 가용성에 미치는 영향 | Low | High | N/A |
벡터
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
취약점 이해 (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Modify Memory
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Even in applications that do not explicitly use function pointers, the run-time will usually leave many in memory. For example, object methods in C++ are generally implemented using function pointers. Even in C programs, there is often a global offset table used by the underlying runtime.
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
