Vulnerability · Published Aug 1, 2024 · Assigned by GitHub_M
CVE-2024-41957Vim double free in src/alloc.c:616
Medium 4.5
In plain English
A medium-severity double free in vim from vim. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vim is an open source command line text editor. Vim < v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack data will be cleared and freed. However a bit later, the quickfix list belonging to that window will also be cleared and if that quickfix list points to the same tagstack data, Vim will try to free it again, resulting in a double-free/use-after-free access exception. Impact is low since the user must intentionally execute vim with several non-default flags, but it may cause a crash of Vim. The issue has been fixed as of Vim patch v9.1.0647
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | vim | 9.1.0652-r0 | ALPINE-CVE-2024-41957 |
| Alpine:v3.21 | vim | 9.1.0652-r0 | ALPINE-CVE-2024-41957 |
| Alpine:v3.22 | vim | 9.1.0652-r0 | ALPINE-CVE-2024-41957 |
| Alpine:v3.23 | vim | 9.1.0652-r0 | ALPINE-CVE-2024-41957 |
| Alpine:v3.24 | vim | 9.1.0652-r0 | ALPINE-CVE-2024-41957 |
| Debian:12 | vim | no fix listed | DEBIAN-CVE-2024-41957 |
| Debian:13 | vim | 2:9.1.0698-1 | DEBIAN-CVE-2024-41957 |
| Debian:14 | vim | 2:9.1.0698-1 | DEBIAN-CVE-2024-41957 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.18 | USN-6993-1 |
| Ubuntu:22.04:LTS | vim | 2:8.2.3995-1ubuntu2.18 | UBUNTU-CVE-2024-41957 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.2 | UBUNTU-CVE-2024-41957 |
| Ubuntu:24.04:LTS | vim | 2:9.1.0016-1ubuntu7.2 | USN-6993-1 |
Affected products (as reported)
Weakness: CWE-415 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/vim/vim/security/advisories/GHSA-f9cr-gv85-hcr4 x_refsource_CONFIRM
- https://github.com/vim/vim/commit/8a0bbe7b8aad6f8da28dee218c01bc8a0185a x_refsource_MISC
- http://www.openwall.com/lists/oss-security/2024/08/01/1
- https://security.netapp.com/advisory/ntap-20241129-0007/
- http://seclists.org/fulldisclosure/2024/Sep/33