PT-2022-1730 · Vim+11 · Vim+11

Brammool · Published 2022-01-25 · Updated 2025-03-30 · CVE-2022-0392

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vim versions prior to 8.2

Description The issue is related to a heap-based buffer overflow in the vim text editor, specifically in the getexmodeline() function. This overflow can be exploited to cause a buffer overflow, potentially allowing an attacker to execute arbitrary code. The estimated number of potentially affected devices is not provided.

Recommendations For versions prior to 8.2, update to version 8.2 or later to resolve the issue. As a temporary workaround, consider disabling the getexmodeline() function until a patch is available.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

ALSA-2022:0894

ALT-PU-2022-1693

ALT-PU-2022-1711

ALT-PU-2022-1731

ALT-PU-2022-1771

AZL-8365

BDU:2022-00992

CESA-2022_0894

CVE-2022-0392

DLA-3204-1

DLA-4097-1

OESA-2022-1514

OPENSUSE-SU-2022_2102-1

OPENSUSE-SU-2024:12337-1

RHSA-2022:0894

RHSA-2022_0894

RLSA-2022:0894

SUSE-SU-2022:2102-1

SUSE-SU-2022:4619-1

USN-5801-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Debian

Linuxmint

Apple Macos

Red Hat

Rocky Linux

Suse

Ubuntu

Vim

References · 307

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0392.json · Exploit
• 🔥 https://huntr.dev/bounties/d00a2acd-1935-4195-9d5b-4115ef6b3126 · Exploit
• https://github.com/vim/vim/commit/806d037671e133bd28a7864248763f643967973a · Patch
• https://osv.dev/vulnerability/ALPINE-CVE-2022-0392 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-0894.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12337-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-0392 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:0894 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4097-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0368 · Security Note
• https://ubuntu.com/security/CVE-2022-0417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0417 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-0408 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0392 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/681982 · Security Note