The UNIX editor Vim prior to version 9.1.0678 has a use-after-free error in argument list handling. When adding a new file to the argument list, this triggers Buf* autocommands. If in such an autocommand the buffer that was just opened is closed (including the window where it is shown), this causes the window structure to be freed which contains a reference to the argument list that we are actually modifying. Once the autocommands are completed, the references to the window and argument list are no longer valid and as such cause an use-after-free. Impact is low since the user must either intentionally add some unusual autocommands that wipe a buffer during creation (either manually or by sourcing a malicious plugin), but it will crash Vim. The issue has been fixed as of Vim patch v9.1.0678.
{
"cwe_ids": [
"CWE-416"
]
}[
{
"signature_type": "Function",
"digest": {
"function_hash": "23268502640491223538498109215581903914",
"length": 1568.0
},
"target": {
"file": "src/terminal.c",
"function": "term_after_channel_closed"
},
"signature_version": "v1",
"id": "CVE-2024-43374-06a44c42",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"27676801470141722002695605065659309826",
"274136091290085859712803694776840632648",
"95187214763660831100839881044961502192",
"20580097290675622387978236348495682961"
]
},
"target": {
"file": "src/structs.h"
},
"signature_version": "v1",
"id": "CVE-2024-43374-0e15d81b",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "302442309805326173830655186755897424593",
"length": 482.0
},
"target": {
"file": "src/arglist.c",
"function": "alist_add"
},
"signature_version": "v1",
"id": "CVE-2024-43374-3840ded4",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "285287504911461864651926552286475341993",
"length": 11352.0
},
"target": {
"file": "src/ex_cmds.c",
"function": "do_ecmd"
},
"signature_version": "v1",
"id": "CVE-2024-43374-45b05209",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "250565783122775206324344534398706783448",
"length": 897.0
},
"target": {
"file": "src/arglist.c",
"function": "alist_add_list"
},
"signature_version": "v1",
"id": "CVE-2024-43374-5903075f",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"139081044701802438687807380237306825472",
"16130154999049864527795482925487278256",
"153087190605048840787127495415886693822",
"171036842537978881902924749312976932045",
"686675886637406598219423700442462967",
"250027109555501571559337129236562531916",
"310728658493157355722821322064544141581",
"71978820375907382561308353453941311",
"156104722742999423990427469219761503486",
"292091505100313022326368415325830062417",
"205829687884037237728893212719428306021",
"260172004496452205671711920308164312398",
"105404537272627456607336257786273529074",
"70436147176586748500315612534403603665",
"204268089123793975570035237560967789579",
"298563925794507509042161880191579944126",
"164862539038146417078391297821024464697",
"211852102870019407433849102061427575711",
"335759790279175732639249370752191763706",
"294406754815128678480472447700628445938",
"227788481041817628483178138494957156953",
"305061779242106239034181510532887414742",
"287054698987305275740992391859460028008",
"211400287380998839621003282474333039467",
"326365843427594379601815091604074657650",
"27642168738304933664663102500150789430",
"312105946101274395928293228379351364035",
"151833837018723133489981310060691716594",
"139637810617450696512808477993524316478",
"177897116197129886839199303953243227360",
"237977761971690276405438034895910399118",
"139456919999779789311726032886907282969",
"326365843427594379601815091604074657650",
"27642168738304933664663102500150789430",
"72002328512201157316706733369753385157",
"329052807157358588382514372331528845999",
"228867019531280229868263390986302016148",
"21516023801586995595538955876844763189",
"66638559985534446474523043406815337257",
"253476756149469924704447165285154752471"
]
},
"target": {
"file": "src/window.c"
},
"signature_version": "v1",
"id": "CVE-2024-43374-5bd177a6",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"166113013522332390164509407920996504008",
"301169412098089150488030871966243135022",
"133680302274963891266110956355954638887",
"89915508867405449154757850911994646441",
"191860546124444498264712736010846093350",
"50317516310201420555062558468939456380",
"1507403679155778484379546249128128857",
"140198752257304987069431048744214496259"
]
},
"target": {
"file": "src/buffer.c"
},
"signature_version": "v1",
"id": "CVE-2024-43374-6bd167c8",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "80700937113803823485584421007485740200",
"length": 2825.0
},
"target": {
"file": "src/buffer.c",
"function": "ex_buffer_all"
},
"signature_version": "v1",
"id": "CVE-2024-43374-7634fc8e",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146200493773228420153804765641940418619",
"303350083516222927057725054872132373757",
"96824593211526899356549637190609859623",
"38412983457431178554171818788384542345"
]
},
"target": {
"file": "src/version.c"
},
"signature_version": "v1",
"id": "CVE-2024-43374-829969d7",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "222726146019689791197391592517614973164",
"length": 602.0
},
"target": {
"file": "src/window.c",
"function": "win_close_buffer"
},
"signature_version": "v1",
"id": "CVE-2024-43374-920d27cf",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"217598491622927398771921855388202265925",
"124569386884548732916779532465051937687",
"339657063770994482971889086529869986596",
"230823516118869833593541703572669542830",
"105501207107844815148724044062299482165",
"199711488793540980257345154942177886661",
"171750511103518499748861575606239483549"
]
},
"target": {
"file": "src/terminal.c"
},
"signature_version": "v1",
"id": "CVE-2024-43374-9707704d",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "180508128104436460063574824735757745158",
"length": 866.0
},
"target": {
"file": "src/window.c",
"function": "close_windows"
},
"signature_version": "v1",
"id": "CVE-2024-43374-9f80942c",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "217932166629076209668564951052780954626",
"length": 4075.0
},
"target": {
"file": "src/window.c",
"function": "win_close"
},
"signature_version": "v1",
"id": "CVE-2024-43374-ae7f7b74",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34511382149172304150241495636521779265",
"104478917301252940802365409046449350529",
"52673352943668731536035361860334724266",
"112117926939457956460049113854128605008",
"42259245746687173763350634398472693816",
"134583666138628112531235338870680780443",
"252246393303873081644984867061945239066",
"261325307918153196850613099792180643531"
]
},
"target": {
"file": "src/ex_cmds.c"
},
"signature_version": "v1",
"id": "CVE-2024-43374-cbde2f2c",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "275214950971697618483013450148670419708",
"length": 1343.0
},
"target": {
"file": "src/window.c",
"function": "win_close_othertab"
},
"signature_version": "v1",
"id": "CVE-2024-43374-d043281c",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"88135516828833340299805919438817870289",
"99056319061021921697312839754809236877",
"247106147661198956955142943555444752367",
"44626685314551541299339776096986071470",
"150286781316637155035127566413561136702",
"275599168783202500076615353175672851047",
"170866462787792110091741149843038009397",
"20969955342689790979405278713881526951",
"147326731723099265365867460173325397860",
"232882941929483429700724211251947689405",
"279776651257948467165511183635800798678",
"71634241392564864013694106155459873148",
"209823752459720161534841839955220146144",
"306748141608099665136169193471809176217",
"234167651035342926680595915050230142686",
"302533169278117023454946675178625276568",
"320828844111317150379942821683367348080",
"45893730133554088775966331595261894351",
"293654292483758350535499238630179441268"
]
},
"target": {
"file": "src/arglist.c"
},
"signature_version": "v1",
"id": "CVE-2024-43374-f589dbf3",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
},
{
"signature_type": "Function",
"digest": {
"function_hash": "217660663114029999773586032019335783970",
"length": 5750.0
},
"target": {
"file": "src/buffer.c",
"function": "do_buffer_ext"
},
"signature_version": "v1",
"id": "CVE-2024-43374-faf14b0e",
"deprecated": false,
"source": "https://github.com/vim/vim/commit/0a6e57b09bc8c76691b367a5babfb79b31b770e8"
}
]