CVE-2022-2845

Description

From CVE.org

Improper Validation of Specified Quantity in Input in GitHub repository vim/vim prior to 9.0.0218.

Mitigation

Untrusted vim scripts with -s [scriptin] are not recommended to run.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score2.87.8N/A
Attack VectorLocalLocalN/A
Attack ComplexityLowLowN/A
Privileges RequiredLowNoneN/A
User InteractionRequiredRequiredN/A
ScopeUnchangedUnchangedN/A
ConfidentialityNoneHighN/A
Integrity ImpactNoneHighN/A
Availability ImpactLowHighN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

NVD: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Red Hat CVSS v3 Score Explanation

C:N and I:N as this is an out-of-bounds read and vim does not have a way to exfil the read byte, therefore the risk is limited to availability rather than integrity or confidentiality. A:L because vim can be reopened by a user who does not open the malicious file in script mode.

Understanding the Weakness (CWE)

CWE-127

Confidentiality

Technical Impact: Read Memory

Confidentiality

Technical Impact: Bypass Protection Mechanism

By reading out-of-bounds memory, an attacker might be able to get secret values, such as memory addresses, which can bypass protection mechanisms such as ASLR in order to improve the reliability and likelihood of exploiting a separate weakness to achieve code execution instead of just denial of service.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.