CVE-2024-43790: Vim Buffer Overflow Vulnerability

CVE-2024-43790 Overview

CVE-2024-43790 is a heap-based buffer overflow vulnerability in the Vim text editor that occurs when handling search patterns containing ASCII NUL characters while right-left mode is enabled. The flaw exists in the do_search() function and can be triggered when displaying search-count messages is disabled (:set shm+=S) and right-left mode is active (:set rl).

When performing a search under these conditions, Vim allocates a new buffer for the reversed search pattern. However, if the search pattern contains embedded NUL bytes, the strlen() function used to determine the buffer size terminates prematurely at the first NUL byte. This results in an undersized buffer allocation while the original length indicator remains incorrect, leading to a heap-based buffer overflow when accessing characters in the message buffer.

Critical Impact

Local attackers can exploit this vulnerability to cause a denial of service condition through application crashes. The vulnerability requires local access and user interaction with a maliciously crafted search pattern.

Affected Products

• Vim versions prior to v9.1.0689
• NetApp Bootstrap OS
• NetApp HCI Compute Node

Discovery Timeline

• 2024-08-22 - CVE-2024-43790 published to NVD
• 2025-08-18 - Last updated in NVD database

Technical Details for CVE-2024-43790

Vulnerability Analysis

This vulnerability is classified as CWE-122 (Heap-based Buffer Overflow). The root issue lies in the inconsistent buffer length calculation when reversing search patterns containing embedded NUL characters in right-left mode.

When a user performs a search with :set rl enabled and :set shm+=S configured, Vim reverses the search pattern for display in the message buffer (msgbuf). The reversal process allocates a new buffer using strlen() to determine the required size. However, strlen() only counts characters until it encounters the first NUL byte, causing the allocated buffer to be smaller than necessary when the original pattern contains embedded NUL characters.

The msgbuflen variable, which tracks the buffer length, is not updated after the new allocation. Subsequent operations that access the message buffer use the original (now incorrect) length value, resulting in out-of-bounds memory access.

Root Cause

The vulnerability stems from a missing length recalculation after buffer reallocation. When the search pattern is reversed for right-left mode display, a new buffer is allocated but the msgbuflen variable retains the original buffer's length value. This mismatch causes heap-based buffer overflow when the code attempts to access characters beyond the actual allocated buffer size.

Attack Vector

This vulnerability requires local access to the system running Vim. An attacker must be able to:

1. Configure Vim with right-left mode enabled (:set rl)
2. Disable search-count message display (:set shm+=S)
3. Execute a search operation with a pattern containing embedded NUL bytes

The attack vector is local, requiring low privileges and no user interaction beyond the search operation itself. Successful exploitation results in application crash causing denial of service.

The official patch addresses this by updating the msgbuflen variable after buffer reallocation:

 			{
 			    vim_free(msgbuf);
 			    msgbuf = r;
+			    msgbuflen = STRLEN(msgbuf);
 			    // move reversed text to beginning of buffer
 			    while (*r != NUL && *r == ' ')
 				r++;

Source: GitHub Commit

Detection Methods for CVE-2024-43790

Indicators of Compromise

• Unexpected Vim crashes during search operations
• Core dump files indicating heap corruption in Vim processes
• Vim processes terminating with segmentation faults when right-left mode is active
• Anomalous memory access patterns in Vim process logs

Detection Strategies

• Monitor for repeated Vim process crashes with heap-related error signatures
• Implement endpoint detection rules for Vim processes experiencing memory corruption
• Deploy application crash monitoring to detect exploitation attempts
• Review system logs for Vim segmentation faults during search operations

Monitoring Recommendations

• Enable crash reporting for Vim processes across managed endpoints
• Monitor for unusual Vim configuration changes enabling right-left mode
• Track Vim version deployments to identify unpatched instances
• Implement file integrity monitoring on Vim binaries to detect unauthorized modifications

How to Mitigate CVE-2024-43790

Immediate Actions Required

• Upgrade Vim to version 9.1.0689 or later immediately
• Review and inventory all systems running vulnerable Vim versions
• Consider temporarily disabling right-left mode (:set norl) on critical systems until patching is complete
• Apply vendor-provided patches for NetApp Bootstrap OS and HCI Compute Node deployments

Patch Information

The vulnerability has been fixed in Vim patch v9.1.0689. The fix ensures that msgbuflen is properly updated after buffer reallocation when reversing search patterns. Organizations should update Vim through their standard package management systems or compile from the latest source.

For detailed patch information, refer to the GitHub Security Advisory and the GitHub Commit.

NetApp users should consult the NetApp Advisory NTAP-20240920-0005 for specific guidance on affected products.

Workarounds

• Disable right-left mode by adding set norl to your .vimrc configuration
• Enable search-count messages by removing S from the shortmess option
• Use alternative text editors for operations requiring right-left text display until patching is possible
• Restrict access to Vim on shared systems where untrusted users may trigger vulnerable code paths

# Configuration to mitigate the vulnerability
# Add to ~/.vimrc or /etc/vimrc
set norl
" Or ensure search count messages are displayed
set shortmess-=S