Bug 33944 - vim new security issue CVE-2025-24014
Summary: vim new security issue CVE-2025-24014
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA9-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2025-01-21 09:29 CET by Nicolas Salguero
Modified: 2025-02-05 20:52 CET (History)
3 users (show)

See Also:
Source RPM: vim-9.1.1012-1.mga9
CVE: CVE-2025-24014
Status comment:


Attachments

Description Nicolas Salguero 2025-01-21 09:29:47 CET
CVE-2025-24014 was announced here:
https://www.openwall.com/lists/oss-security/2025/01/20/4
Nicolas Salguero 2025-01-21 09:30:51 CET

Whiteboard: (none) => MGA9TOO
CVE: (none) => CVE-2025-24014
Status comment: (none) => Fixed upstream in 9.1.1043
Source RPM: (none) => vim-9.1.1012-1.mga9.src.rpm

Comment 1 Nicolas Salguero 2025-01-21 10:22:00 CET
Suggested advisory:
========================

The updated packages fix a security vulnerability:

segmentation fault in win_line() in Vim < 9.1.1043. (CVE-2025-24014)

References:
https://www.openwall.com/lists/oss-security/2025/01/20/4
========================

Updated packages in core/updates_testing:
========================
vim-X11-9.1.1043-1.mga9
vim-common-9.1.1043-1.mga9
vim-enhanced-9.1.1043-1.mga9
vim-minimal-9.1.1043-1.mga9

from SRPM:
vim-9.1.1043-1.mga9.src.rpm

Assignee: bugsquad => qa-bugs
Status comment: Fixed upstream in 9.1.1043 => (none)
Status: NEW => ASSIGNED
Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9

Comment 2 Thomas Andrews 2025-01-21 15:45:39 CET
It occurs to me that in the past some vim updates have affected neovim, as well. The last round, a few days ago, did not list neovim, and I just want to be sure we aren't missing something.

Does this, or that last update, affect neovim?

CC: (none) => andrewsfarm

Comment 3 katnatek 2025-01-21 20:08:45 CET
RH x86_64

Again is not difference for me with the poc with the current neither updated packages

And the previous poc still do the same for me

installing vim-common-9.1.1043-1.mga9.x86_64.rpm vim-minimal-9.1.1043-1.mga9.x86_64.rpm vim-X11-9.1.1043-1.mga9.x86_64.rpm vim-enhanced-9.1.1043-1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/4: vim-common            ##################################################################################################
      2/4: vim-X11               ##################################################################################################
      3/4: vim-enhanced          ##################################################################################################
      4/4: vim-minimal           ##################################################################################################
      1/4: removing vim-enhanced-9.1.1012-1.mga9.x86_64
                                 ##################################################################################################
      2/4: removing vim-X11-9.1.1012-1.mga9.x86_64
                                 ##################################################################################################
      3/4: removing vim-common-9.1.1012-1.mga9.x86_64
                                 ##################################################################################################
      4/4: removing vim-minimal-9.1.1012-1.mga9.x86_64
                                 ##################################################################################################

Look good for me in the regular use
katnatek 2025-01-21 20:12:40 CET

Keywords: (none) => advisory

Comment 4 Nicolas Salguero 2025-01-22 09:28:05 CET
(In reply to Thomas Andrews from comment #2)
> It occurs to me that in the past some vim updates have affected neovim, as
> well. The last round, a few days ago, did not list neovim, and I just want
> to be sure we aren't missing something.
> 
> Does this, or that last update, affect neovim?

Thanks for the reminder.  As far as I can see, the two latest CVEs that affect vim, including this one, do not affect neovim.
Comment 5 Thomas Andrews 2025-01-22 14:29:35 CET
OK, just checking. (Part of my job...)
Comment 6 katnatek 2025-01-22 18:26:34 CET
Len if you could check the poc for this bug, thank you

CC: (none) => tarazed25

katnatek 2025-01-22 18:53:12 CET

Source RPM: vim-9.1.1012-1.mga9.src.rpm => vim-9.1.1012-1.mga9

Comment 7 Len Lawrence 2025-01-22 22:15:40 CET
In reply to katnatek in comment #6:

Sorry I did not comment before; had already had a look at the github link
https://github.com/vim/vim/commit/9d1bed5eccdbb46a26b8a484f5e9163c40e63919#diff-ea763fdb2cbd2223b87bfc5dcbc65b0d0b7a9e07c7738d3ff1d136b98dce06fc

and failed to see how to run the check.  It looks like the ex_redraw_crash file is a target for func Test_crash1_3() in some file not named.  Maybe in vim itself or a test suite?  I am not a developer so the references do not make much sense to me.  I did try creating the ex_redraw_crash file then feeding it to vim, which before and after the update says nothing, but I have no confidence in it - the expected reply afterwards might be ":qa!". 

$ vim -u NONE -i NONE -n -m -X -Z -e -s -S -c ':qa!' ex_redraw_crash 
$
Comment 8 katnatek 2025-01-22 23:21:27 CET
(In reply to Len Lawrence from comment #7)
https://github.com/vim/vim/security/advisories/GHSA-j3g9-wg22-v955

In details, you can see also the command and link to test file
Comment 9 Len Lawrence 2025-01-23 03:11:31 CET
(In reply to katnatek from comment #8)
Thanks for the pointer.  Best left until the morning.
Comment 10 Len Lawrence 2025-01-23 12:41:15 CET
mga9, x86_64
Before update:
$ rpm -qa | grep vim-
vim-common-9.1.1012-1.mga9
vim-enhanced-9.1.1012-1.mga9
vim-minimal-9.1.1012-1.mga9
vim-X11-9.1.1012-1.mga9

$ valgrind /usr/bin/vim -u NONE -i NONE -n -m -X -Z -e -s -S vim_SEGV1 -c :qa!
==2402484== Memcheck, a memory error detector
==2402484== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==2402484== Using Valgrind-3.20.0 and LibVEX; rerun with -h for copyright info
==2402484== Command: /usr/bin/vim -u NONE -i NONE -n -m -X -Z -e -s -S vim_SEGV1 -c :qa!
==2402484== 

There it hangs, presumably forever.  Had to remove terminal - ctrl-C fails to
inerrupt it.
The upstream test outputs

==3632033== Invalid write of size 1
[...]
Segmentation fault

$ rpm -qa | grep vim-
vim-common-9.1.1043-1.mga9
vim-enhanced-9.1.1043-1.mga9
vim-X11-9.1.1043-1.mga9
vim-minimal-9.1.1043-1.mga9

After the update the result is exactly the same.  The terminal hangs with no output at all.  No response to ^C but the terminal menu allows another tab to be created, which functions normally.  Killed the original from the tab.

So, this result does not tell us anything useful.

Started gkrellm and ran the POC test again and saw no unusual activity, no change in temperatures.  Watched htop for a while but could not identify valgrind; I guess it appeared long before and rolled out of view.  No other suspicious processes either.  Restarted the test but again could not see anything relevant to mate-terminal or valgrind or vim.

vim still works but maybe it is also still vulnerable?
Comment 11 katnatek 2025-01-23 17:02:09 CET
(In reply to Len Lawrence from comment #10)
> mga9, x86_64
> Before update:
> $ rpm -qa | grep vim-
> vim-common-9.1.1012-1.mga9
> vim-enhanced-9.1.1012-1.mga9
> vim-minimal-9.1.1012-1.mga9
> vim-X11-9.1.1012-1.mga9
> 
> $ valgrind /usr/bin/vim -u NONE -i NONE -n -m -X -Z -e -s -S vim_SEGV1 -c
> :qa!
> ==2402484== Memcheck, a memory error detector
> ==2402484== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
> ==2402484== Using Valgrind-3.20.0 and LibVEX; rerun with -h for copyright
> info
> ==2402484== Command: /usr/bin/vim -u NONE -i NONE -n -m -X -Z -e -s -S
> vim_SEGV1 -c :qa!
> ==2402484== 
> 
> There it hangs, presumably forever.  Had to remove terminal - ctrl-C fails to
> inerrupt it.
> The upstream test outputs
> 
> ==3632033== Invalid write of size 1
> [...]
> Segmentation fault
> 
> $ rpm -qa | grep vim-
> vim-common-9.1.1043-1.mga9
> vim-enhanced-9.1.1043-1.mga9
> vim-X11-9.1.1043-1.mga9
> vim-minimal-9.1.1043-1.mga9
> 
> After the update the result is exactly the same.  The terminal hangs with no
> output at all.  No response to ^C but the terminal menu allows another tab
> to be created, which functions normally.  Killed the original from the tab.
> 
> So, this result does not tell us anything useful.
> 
> Started gkrellm and ran the POC test again and saw no unusual activity, no
> change in temperatures.  Watched htop for a while but could not identify
> valgrind; I guess it appeared long before and rolled out of view.  No other
> suspicious processes either.  Restarted the test but again could not see
> anything relevant to mate-terminal or valgrind or vim.
> 
> vim still works but maybe it is also still vulnerable?

This is a call for you Nicolas

Keywords: (none) => feedback

Comment 12 Nicolas Salguero 2025-02-04 14:51:01 CET
(In reply to katnatek from comment #11)
> This is a call for you Nicolas

Hi,

As I understand it, the fact that the output does not contain:
"""
Invalid write of size 1
[...]
Segmentation fault
"""
after the update means the security issue is fixed, even though ctrl-C fails to interrupt the process.
Comment 13 katnatek 2025-02-04 22:55:19 CET
@Len if you confirm that the "Segmentation fault" no longer is present we can validate this
Comment 14 Len Lawrence 2025-02-05 03:15:15 CET
@katnatek: will do if I can find which system I was running the update on.  I have been switching around just lately and have lost my place.  Later.
Comment 15 Len Lawrence 2025-02-05 03:25:05 CET
Ahh.  This seems to be it.

$ valgrind /usr/bin/vim -u NONE -i NONE -n -m -X -Z -e -s -S vim_SEGV1 -c :qa!
==3080147== Memcheck, a memory error detector
==3080147== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==3080147== Using Valgrind-3.20.0 and LibVEX; rerun with -h for copyright info
==3080147== Command: /usr/bin/vim -u NONE -i NONE -n -m -X -Z -e -s -S vim_SEGV1 -c :qa!
==3080147== 
==3080147== 
==3080147== HEAP SUMMARY:
==3080147==     in use at exit: 166,241 bytes in 407 blocks
==3080147==   total heap usage: 1,069 allocs, 662 frees, 281,832 bytes allocated
==3080147== 
==3080147== LEAK SUMMARY:
==3080147==    definitely lost: 8,192 bytes in 1 blocks
==3080147==    indirectly lost: 0 bytes in 0 blocks
==3080147==      possibly lost: 87,552 bytes in 4 blocks
==3080147==    still reachable: 70,497 bytes in 402 blocks
==3080147==         suppressed: 0 bytes in 0 blocks
==3080147== Rerun with --leak-check=full to see details of leaked memory
==3080147== 
==3080147== For lists of detected and suppressed errors, rerun with: -s
==3080147== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

Clean exit, no hang or segfault.
It seems odd that the test runs differently this time, but it looks OK.
$ rpm -qa | grep vim
vim-common-9.1.1043-1.mga9
vim-enhanced-9.1.1043-1.mga9
vim-X11-9.1.1043-1.mga9
vim-minimal-9.1.1043-1.mga9


lcl@yildun:~ $ ls /usr/bin/vim
/usr/bin/vim@
lcl@yildun:~ $ ll /usr/bin/vim
lrwxrwxrwx 1 root root 21 Jul 13  2023 /usr/bin/vim -> /etc/alternatives/vim*
katnatek 2025-02-05 03:32:15 CET

Keywords: feedback => (none)
Whiteboard: (none) => MGA9-64-OK

Comment 16 Thomas Andrews 2025-02-05 16:16:36 CET
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 17 Mageia Robot 2025-02-05 20:52:10 CET
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0038.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.