VIM SEGMENTATION FAULT OBSERVED for RHEL8/ALMA8.

[Bali3, Varun]

 

Hi,

We are facing segmentation fault in vim-enhanced rpm, when we are opening two or more files simultaneously from vim on same server, then if we reboot the system vim generates core/crashes. Attaching gdb log for same and core file for same.


Regards,

Varun Bali

[Christian Brabandt]

On Di, 31 Okt 2023, 'Bali3, Varun' via vim_dev wrote:

>
> Hi,
>
> We are facing segmentation fault in vim-enhanced rpm, when we are opening two or more files simultaneously from vim on same server, then if we reboot the system vim generates core/crashes. Attaching gdb log for same and core file for same.

Unfortunately, the stack trace doesn't tell us much, since no debugging
symbols are enabled. Also I see that your vim is 8.0.1763 which is quite
old.

So can you
- reproduce the crash using a newer Vim?
- do you have steps what you did to make this crash happen?

Otherwise I am afraid we cannot help much here.

Thanks,
Christian
--
Men take only their needs into consideration -- never their abilities.
-- Napoleon Bonaparte

[varun bali]

Hi Christian,
When we open two or more files on same server and then restart the same server, all these things are done from different terminals but same server, then after restart we see core is generated for vim-enhanced rpm. Are there any bugs reported that might cause this segmentation fault. We have enough memory and inodes available.

Regards,

Varun Bali

[Christian Brabandt]

On Di, 31 Okt 2023, varun bali wrote:

> Hi Christian,
> When we open two or more files on same server and then restart the same server, all these things are done from different terminals but same server, then after restart we see core is generated for vim-enhanced rpm. Are there any bugs
> reported that might cause this segmentation fault. We have enough memory and inodes available.

So, does it happen with vim --clean? Have you tried with an up to date
Vim? Please verify this first. Also please try to get a debugging
enabled Vim, so that the stack trace is actually readable.


Thanks,
Christian
--
If you suspect that this message may have been intercepted or amended,
please call the sender.

[varun bali]

We are facing this issue with normal vim execution eg, vim history.log, we will try to reproduce with latest version from ALMA8 repository and will update you accordingly.

[Christian Brabandt]

On Di, 31 Okt 2023, varun bali wrote:

> We are facing this issue with normal vim execution eg, vim history.log, we will try to reproduce with latest version from ALMA8 repository and will update you accordingly.

I have no idea what ALMA8 repository offers, but please try latest
master which is currently at 9.0.2081


Thanks,
Christian
--
Not recommended for children.

[varun bali]

Hi Christian,

We can only take latest from ALMA repository i.e. a limitation of delivering to our customer. if you can point out any bugs that have been fixed for segmentation faults or related to corrupt memory allocation in lower version then we can consider taking from master.

 ALMA latest rpm link: 

https://repo.almalinux.org/almalinux/8/AppStream/x86_64/os/Packages/vim-enhanced-8.0.1763-19.el8_6.4.x86_64.rpm

[Christian Brabandt]

On Di, 31 Okt 2023, varun bali wrote:

> We can only take latest from ALMA repository i.e. a limitation of delivering to our customer. if you can point out any bugs that have been fixed for segmentation faults or related to corrupt memory allocation in lower version then we can consider taking from master.
>  ALMA latest rpm link: 

Well, yes, there have been many bugs fixed since 8.0.1763, after all
8.0.1763 has been released more than 5 years ago.
You can check yourself:

git log --reverse v8.0.1763..master

There have been many security related fixes in between, as well as asan
fixes and other potential crashes.

Thanks,
Christian
--
It is the wise bird who builds his nest in a tree.

[varun bali]

Hi Christian,

We've identified a SIGSEGV crash in Vim at malloc() (__libc_calloc) that might be related to issues when writing to the .viminfo file during the exit process. It looks like Vim is failing to write to the .viminfo file, here " write_viminfo() " function is called,
Can you please help us point out some CVE's that might address this issue of segmentation fault or memory corruption.

In ALMA we have this CVE's fixed  8.0.1763-19.2 onwards:
2022-06-14 - Zdenek Dohnal <zdo...@redhat.com> - 2:8.0.1763-19.4 - fix issue reported by covscan2022-06-13 - Zdenek Dohnal <zdo...@redhat.com> - 2:8.0.1763-19.3 - CVE-2022-1785 vim: Out-of-bounds Write - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c
Regards,

Varun Bali

[Christian Brabandt]

On Mi, 01 Nov 2023, varun bali wrote:

> We've identified a SIGSEGV crash in Vim at malloc() (__libc_calloc) that might be related to issues when writing to the .viminfo file during the exit process. It looks like Vim is failing to write to the .viminfo file, here " write_viminfo() " function is called,
> Can you please help us point out some CVE's that might address this issue of segmentation fault or memory corruption.

No I cannot. Please verify first with updated master version. If you can
still reproduce the issue, get a debugging build and get us a proper
stack trace of the crash and/or provide us with an ASAN log. But I
assume, current master doesn't have the problem.

Thanks,
Chris
--
I'm going to Boston to see my doctor. He's a very sick man.
-- Fred Allen