Skip to content

Commit 65a3f01

Browse files
SumynwaSumynwa
authored
vim: Add patch to resolve CVE-2024-41957 & CVE-2024-41965. (#10081)
1 parent 030781f commit 65a3f01

3 files changed

Lines changed: 157 additions & 1 deletion

File tree

‎SPECS/vim/CVE-2024-41957.patch‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
Modified patch to apply to older version
2+
Modifed by: sumsharma@microsoft.com
3+
4+
From 8a0bbe7b8aad6f8da28dee218c01bc8a0185a2d5 Mon Sep 17 00:00:00 2001
5+
From: Christian Brabandt <cb@256bit.org>
6+
Date: Thu, 1 Aug 2024 20:16:51 +0200
7+
Subject: [PATCH] patch 9.1.0647: [security] use-after-free in
8+
tagstack_clear_entry
9+
10+
Problem: [security] use-after-free in tagstack_clear_entry
11+
(Suyue Guo )
12+
Solution: Instead of manually calling vim_free() on each of the tagstack
13+
entries, let's use tagstack_clear_entry(), which will
14+
also free the stack, but using the VIM_CLEAR macro,
15+
which prevents a use-after-free by setting those pointers
16+
to NULL
17+
18+
This addresses CVE-2024-41957
19+
20+
Github advisory:
21+
https://github.com/vim/vim/security/advisories/GHSA-f9cr-gv85-hcr4
22+
23+
Signed-off-by: Christian Brabandt <cb@256bit.org>
24+
---
25+
src/proto/tag.pro | 1 +
26+
src/tag.c | 4 ++--
27+
src/window.c | 6 ++----
28+
3 files changed, 5 insertions(+), 6 deletions(-)
29+
30+
diff --git a/src/proto/tag.pro b/src/proto/tag.pro
31+
index 6de463e..eec7c24 100644
32+
--- a/src/proto/tag.pro
33+
+++ b/src/proto/tag.pro
34+
@@ -14,4 +14,5 @@ int expand_tags(int tagnames, char_u *pat, int *num_file, char_u ***file);
35+
int get_tags(list_T *list, char_u *pat, char_u *buf_fname);
36+
void get_tagstack(win_T *wp, dict_T *retdict);
37+
int set_tagstack(win_T *wp, dict_T *d, int action);
38+
+void tagstack_clear_entry(taggy_T *item);
39+
/* vim: set ft=c : */
40+
diff --git a/src/tag.c b/src/tag.c
41+
index 8003156..31b89e7 100644
42+
--- a/src/tag.c
43+
+++ b/src/tag.c
44+
@@ -144,7 +144,7 @@ static void print_tag_list(int new_tag, int use_tagstack, int num_matches, char_
45+
#if defined(FEAT_QUICKFIX) && defined(FEAT_EVAL)
46+
static int add_llist_tags(char_u *tag, int num_matches, char_u **matches);
47+
#endif
48+
-static void tagstack_clear_entry(taggy_T *item);
49+
+void tagstack_clear_entry(taggy_T *item);
50+
51+
static char_u *tagmatchname = NULL; // name of last used tag
52+
53+
@@ -4225,7 +4225,7 @@ find_extra(char_u **pp)
54+
/*
55+
* Free a single entry in a tag stack
56+
*/
57+
- static void
58+
+void
59+
tagstack_clear_entry(taggy_T *item)
60+
{
61+
VIM_CLEAR(item->tagname);
62+
diff --git a/src/window.c b/src/window.c
63+
index 55ce31c..ffffde8 100644
64+
--- a/src/window.c
65+
+++ b/src/window.c
66+
@@ -5661,10 +5661,8 @@ win_free(
67+
win_free_lsize(wp);
68+
69+
for (i = 0; i < wp->w_tagstacklen; ++i)
70+
- {
71+
- vim_free(wp->w_tagstack[i].tagname);
72+
- vim_free(wp->w_tagstack[i].user_data);
73+
- }
74+
+ tagstack_clear_entry(&wp->w_tagstack[i]);
75+
+
76+
vim_free(wp->w_localdir);
77+
vim_free(wp->w_prevdir);
78+
79+
--
80+
2.25.1
81+

‎SPECS/vim/CVE-2024-41965.patch‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
Modified patch to apply to older version of vim
2+
Modified by: sumsharma@microsoft.com
3+
4+
From b29f4abcd4b3382fa746edd1d0562b7b48c9de60 Mon Sep 17 00:00:00 2001
5+
From: Christian Brabandt <cb@256bit.org>
6+
Date: Thu, 1 Aug 2024 22:10:28 +0200
7+
Subject: [PATCH] patch 9.1.0648: [security] double-free in dialog_changed()
8+
9+
Problem: [security] double-free in dialog_changed()
10+
(SuyueGuo)
11+
Solution: Only clear pointer b_sfname pointer, if it is different
12+
than the b_ffname pointer. Don't try to free b_fname,
13+
set it to NULL instead.
14+
15+
fixes: #15403
16+
17+
Github Advisory:
18+
https://github.com/vim/vim/security/advisories/GHSA-46pw-v7qw-xc2f
19+
20+
Signed-off-by: Christian Brabandt <cb@256bit.org>
21+
---
22+
---
23+
src/ex_cmds2.c | 25 ++++++++++++++++++++++---
24+
1 file changed, 22 insertions(+), 3 deletions(-)
25+
26+
diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c
27+
index 45ccb52..ede403a 100644
28+
--- a/src/ex_cmds2.c
29+
+++ b/src/ex_cmds2.c
30+
@@ -177,14 +177,33 @@ dialog_changed(
31+
32+
if (ret == VIM_YES)
33+
{
34+
+ int empty_bufname;
35+
+
36+
#ifdef FEAT_BROWSE
37+
// May get file name, when there is none
38+
browse_save_fname(buf);
39+
#endif
40+
- if (buf->b_fname != NULL && check_overwrite(&ea, buf,
41+
- buf->b_fname, buf->b_ffname, FALSE) == OK)
42+
+ empty_bufname = buf->b_fname == NULL ? TRUE : FALSE;
43+
+ if (empty_bufname)
44+
+ buf_set_name(buf->b_fnum, (char_u *)"Untitled");
45+
+
46+
+ if (check_overwrite(&ea, buf, buf->b_fname, buf->b_ffname, FALSE) == OK)
47+
+ {
48+
// didn't hit Cancel
49+
- (void)buf_write_all(buf, FALSE);
50+
+ if (buf_write_all(buf, FALSE) == OK)
51+
+ return;
52+
+ }
53+
+
54+
+ // restore to empty when write failed
55+
+ if (empty_bufname)
56+
+ {
57+
+ // prevent double free
58+
+ if (buf->b_sfname != buf->b_ffname)
59+
+ VIM_CLEAR(buf->b_sfname);
60+
+ buf->b_fname = NULL;
61+
+ VIM_CLEAR(buf->b_ffname);
62+
+ unchanged(buf, TRUE, FALSE);
63+
+ }
64+
}
65+
else if (ret == VIM_NO)
66+
{
67+
--
68+
2.25.1
69+

‎SPECS/vim/vim.spec‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Summary: Text editor
33
Name: vim
44
Version: 9.0.2121
5-
Release: 3%{?dist}
5+
Release: 4%{?dist}
66
License: Vim
77
Vendor: Microsoft Corporation
88
Distribution: Mariner
@@ -11,6 +11,9 @@ URL: https://www.vim.org
1111
Source0: https://github.com/%{name}/%{name}/archive/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
1212
Patch0: CVE-2024-22667.patch
1313
Patch1: CVE-2024-43374.patch
14+
Patch2: CVE-2024-41957.patch
15+
Patch3: CVE-2024-41965.patch
16+
1417
BuildRequires: ncurses-devel
1518
BuildRequires: python3-devel
1619
Requires(post): sed
@@ -198,6 +201,9 @@ fi
198201
%{_bindir}/vimdiff
199202

200203
%changelog
204+
* Wed Sep 18 2024 Sumedh Sharma <sumsharma@microsoft.com> - 9.0.2121-4
205+
- Add patch to resolve CVE-2024-41957 & CVE-2024-41965
206+
201207
* Tue Aug 20 2024 Brian Fjeldstad <bfjelds@microsoft.com> - 9.0.2121-3
202208
- Patch CVE-2024-43374
203209

0 commit comments

Comments
 (0)