CVE-2023-48232: Vim Text Editor DoS Vulnerability

CVE-2023-48232 Overview

CVE-2023-48232 is a Denial of Service vulnerability affecting Vim, the widely-used open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines when smooth scrolling is enabled and the cpo-settings include the 'n' flag. This vulnerability manifests when a window border is present and a wrapped line continues on the next physical line directly in the window border.

Critical Impact
Users with non-default Vim settings may experience application crashes due to unhandled floating point exceptions during smooth scrolling operations with specific window configurations.

Affected Products

Vim versions prior to 9.0.2107
Fedora 37
Fedora 38
Fedora 39

Discovery Timeline

2023-11-16 - CVE-2023-48232 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-48232

Vulnerability Analysis

This vulnerability is classified under CWE-755 (Improper Handling of Exceptional Conditions). The issue occurs within the adjust_plines_for_skipcol function in Vim's scrolling implementation. When smooth scrolling is enabled with specific cpo settings containing the 'n' flag, the application fails to properly validate division operations before execution, leading to a floating point exception (FPE).

The vulnerability requires specific non-default configurations to be exploitable, including smooth scrolling enabled, the 'n' flag in cpo settings, and presence of window borders. While the attack vector is network-based, user interaction is required, and the impact is limited to application crashes (denial of service).

Root Cause

The root cause lies in the adjust_plines_for_skipcol function in src/move.c. When calculating line offsets for overlong lines with window borders present, the code performs a division operation without validating that the divisor (w2 = width + win_col_off2(wp)) is greater than zero. When the combined width value equals zero due to specific window configurations, a floating point exception occurs, crashing the application.

Attack Vector

The vulnerability can be triggered through:

Opening or rendering a specially crafted file with overlong lines in Vim
The user must have non-default settings enabled (smooth scrolling, cpo with 'n' flag)
A window border must be present where wrapped lines continue
The calculation of width + win_col_off2(wp) results in zero, triggering an FPE during division

// Vulnerable code in src/move.c - before patch
    int width = wp->w_width - win_col_off(wp);
    if (wp->w_skipcol >= width)
	return (wp->w_skipcol - width) / (width + win_col_off2(wp)) + 1;
    // Division by zero possible when (width + win_col_off2(wp)) == 0

Source: GitHub Vim Commit

The fix introduces a bounds check to ensure the divisor is greater than zero:

// Patched code in src/move.c - after patch
    int width = wp->w_width - win_col_off(wp);
    int w2 = width + win_col_off2(wp);
    if (wp->w_skipcol >= width && w2 > 0)
	return (wp->w_skipcol - width) / w2 + 1;

Source: GitHub Vim Commit

Detection Methods for CVE-2023-48232

Indicators of Compromise

Unexpected Vim process crashes or terminations
Floating point exception (SIGFPE) signals in system logs associated with Vim processes
Core dumps from Vim containing stack traces in adjust_plines_for_skipcol function

Detection Strategies

Monitor for abnormal Vim process terminations, particularly SIGFPE signals
Review system logs for floating point exceptions tied to the Vim process
Implement endpoint detection rules for unexpected text editor crashes when processing files

Monitoring Recommendations

Configure crash reporting to capture Vim SIGFPE events
Monitor for repeated Vim crashes that could indicate exploitation attempts
Track Vim version deployments across the environment to identify unpatched systems

How to Mitigate CVE-2023-48232

Immediate Actions Required

Upgrade Vim to version 9.0.2107 or later immediately
If upgrading is not immediately possible, temporarily disable smooth scrolling or remove the 'n' flag from cpo settings
Review Vim configurations across systems to identify non-default settings that may expose this vulnerability

Patch Information

The vulnerability has been addressed in commit cb0b99f0672d8446585d26e998343dceca17d1ce which is included in Vim release version 9.0.2107. Users should upgrade to this version or later. The patch is available from the official Vim GitHub repository.

Fedora users should apply the security updates through their package manager:

Additional vendor information is available from the GitHub Vim Security Advisory and NetApp Security Advisory.

Workarounds

There are no known workarounds for this vulnerability according to the official advisory
As a temporary measure, users can reset cpo settings to defaults by running :set cpo&vim in Vim
Disabling smooth scrolling with :set smoothscroll! may reduce exposure until patching is possible

bash

# Update Vim on Fedora systems
sudo dnf update vim

# Verify Vim version after update
vim --version | head -1
# Should show: VIM - Vi IMproved 9.0 (with patch level >= 2107)