CVE-2021-3872
Description
An out-of-bounds write flaw was found in vim's drawscreen.c win_redr_status() function. This flaw allows an attacker to trick a user to open a crafted file with specific arguments in vim, triggering an out-of-bounds write. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.
Statement
This flaw is out of support scope for vim as shipped in Red Hat Enterprise Linux 6 and 7. For more comprehensive information about Red Hat Enterprise Linux support scope, please see https://access.redhat.com/support/policy/updates/errata/
Mitigation
Since this flaw requires user interaction, mitigation is to not open files from untrusted sources using vim.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.6 | 7.8 | 7.8 |
| Attack Vector | Local | Local | Local |
| Attack Complexity | Low | Low | Low |
| Privileges Required | None | None | None |
| User Interaction | Required | Required | Required |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | Low | High | High |
| Integrity Impact | Low | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
We've marked C:L and I:L because although there is indeed an out-of-bounds write possible, the data that is being written is not directly controlled by the attacker, but constrained to static strings already in the program. These can be clearly seen on the patch commit: https://github.com/vim/vim/commit/826bfe4bbd7594188e3d74d2539d9707b1c6a14b
As per CVSSv3 spec, "L" in both C and I metrics corresponds to situations where impact to confidentiality and integrity is possible, but constrained.
We've also marked PR:N UI:R because the likely attack vector here is a victim user opening a malicious file.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
