Fix CVE-2026-73078: code injection in netrw via bookmarks
Backport upstream fix for CVE-2026-73078 (code injection in
netrw via bookmarks) to vim on c8s. The patch escapes the
pipe character '|' in netrw bookmark and history menu
builders to prevent arbitrary Ex command execution through
crafted directory paths. The upstream commit was adapted for
the RHEL 8 tree structure (runtime/autoload/netrw.vim) with
the src/version.c hunk stripped per maintainer rules.
CVE: CVE-2026-73078
Upstream patches:
- 29c6fd090d.patch
Resolves: RHEL-240376
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
Zdenek Dohnal
parent
1a7fc60318
commit
162089b2f4
@ -0,0 +1,87 @@
|
||||
From cb34441ff8740380d1f632dadb0d395f4870a83e Mon Sep 17 00:00:00 2001
|
||||
From: RHEL Packaging Agent <redhat-ymir-agent@redhat.com>
|
||||
Date: Fri, 14 Aug 2026 08:13:18 +0000
|
||||
Subject: [PATCH] patch 9.2.0840: [security]: code injection in netrw via
|
||||
bookmarks
|
||||
|
||||
Problem: [security]: code injection in netrw via bookmarks and history
|
||||
(David Carliez)
|
||||
Solution: Escape the '|' explicitly (Yasuhiro Matsumoto)
|
||||
|
||||
The bookmark and history menu builders interpolate paths into :execute'd
|
||||
:menu commands using g:netrw_menu_escape, which did not escape the Ex
|
||||
command separator '|'. A crafted path could break out of the :menu command
|
||||
and run arbitrary Ex/shell commands when the menu was built or triggered.
|
||||
|
||||
Add '|' to g:netrw_menu_escape for the menu names, escape the :e right-hand
|
||||
side with fnameescape(), and quote the netrw#MakeTgt() argument with
|
||||
string() instead of raw single-quote interpolation.
|
||||
|
||||
Github Security Advisory:
|
||||
https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2
|
||||
|
||||
upstream patch: https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69
|
||||
---
|
||||
runtime/autoload/netrw.vim | 16 +++++++++-------
|
||||
1 file changed, 9 insertions(+), 7 deletions(-)
|
||||
|
||||
diff --git a/runtime/autoload/netrw.vim b/runtime/autoload/netrw.vim
|
||||
index 7534467..9eb566c 100644
|
||||
--- a/runtime/autoload/netrw.vim
|
||||
+++ b/runtime/autoload/netrw.vim
|
||||
@@ -519,7 +519,7 @@ if has("win32") || has("win95") || has("win64") || has("win16")
|
||||
else
|
||||
call s:NetrwInit("g:netrw_glob_escape",'*[]?`{~$\')
|
||||
endif
|
||||
-call s:NetrwInit("g:netrw_menu_escape",'.&? \')
|
||||
+call s:NetrwInit("g:netrw_menu_escape",'.&? \|')
|
||||
call s:NetrwInit("g:netrw_tmpfile_escape",' &;')
|
||||
call s:NetrwInit("s:netrw_map_escape","<|\n\r\\\<C-V>\"")
|
||||
if has("gui_running") && (&enc == 'utf-8' || &enc == 'utf-16' || &enc == 'ucs-4')
|
||||
@@ -4492,13 +4492,14 @@ fun! s:NetrwBookmarkMenu()
|
||||
let cnt= 1
|
||||
for bmd in g:netrw_bookmarklist
|
||||
" call Decho('sil! menu '.g:NetrwMenuPriority.".2.".cnt." ".g:NetrwTopLvlMenu.'Bookmark.'.bmd.' :e '.bmd,'~'.expand("<slnum>"))
|
||||
- let bmd= escape(bmd,g:netrw_menu_escape)
|
||||
+ let ebmd= escape(bmd,g:netrw_menu_escape)
|
||||
+ let fbmd= escape(fnameescape(bmd),'|')
|
||||
|
||||
" show bookmarks for goto menu
|
||||
- exe 'sil! menu '.g:NetrwMenuPriority.".2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks.'.bmd.' :e '.bmd."\<cr>"
|
||||
+ exe 'sil! menu '.g:NetrwMenuPriority.".2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks.'.ebmd.' :e '.fbmd."\<cr>"
|
||||
|
||||
" show bookmarks for deletion menu
|
||||
- exe 'sil! menu '.g:NetrwMenuPriority.".8.2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks\ and\ History.Bookmark\ Delete.'.bmd.' '.cnt."mB"
|
||||
+ exe 'sil! menu '.g:NetrwMenuPriority.".8.2.".cnt." ".g:NetrwTopLvlMenu.'Bookmarks\ and\ History.Bookmark\ Delete.'.ebmd.' '.cnt."mB"
|
||||
let cnt= cnt + 1
|
||||
endfor
|
||||
|
||||
@@ -4514,8 +4515,9 @@ fun! s:NetrwBookmarkMenu()
|
||||
let priority = g:netrw_dirhist_cnt + histcnt
|
||||
if exists("g:netrw_dirhist_{cnt}")
|
||||
let histdir= escape(g:netrw_dirhist_{cnt},g:netrw_menu_escape)
|
||||
+ let ehistdir= escape(fnameescape(g:netrw_dirhist_{cnt}),'|')
|
||||
" call Decho('sil! menu '.g:NetrwMenuPriority.".3.".priority." ".g:NetrwTopLvlMenu.'History.'.histdir.' :e '.histdir,'~'.expand("<slnum>"))
|
||||
- exe 'sil! menu '.g:NetrwMenuPriority.".3.".priority." ".g:NetrwTopLvlMenu.'History.'.histdir.' :e '.histdir."\<cr>"
|
||||
+ exe 'sil! menu '.g:NetrwMenuPriority.".3.".priority." ".g:NetrwTopLvlMenu.'History.'.histdir.' :e '.ehistdir."\<cr>"
|
||||
endif
|
||||
let first = 0
|
||||
let cnt = ( cnt - 1 ) % g:netrw_dirhistmax
|
||||
@@ -8854,7 +8856,7 @@ fun! s:NetrwTgtMenu()
|
||||
let ebmd= escape(bmd,g:netrw_menu_escape)
|
||||
" show bookmarks for goto menu
|
||||
" call Decho("menu: Targets: ".bmd,'~'.expand("<slnum>"))
|
||||
- exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.1.".cnt." ".g:NetrwTopLvlMenu.'Targets.'.ebmd." :call netrw#MakeTgt('".bmd."')\<cr>"
|
||||
+ exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.1.".cnt." ".g:NetrwTopLvlMenu.'Targets.'.ebmd." :call netrw#MakeTgt(".escape(string(bmd),'|').")\<cr>"
|
||||
let cnt= cnt + 1
|
||||
endfor
|
||||
endif
|
||||
@@ -8874,7 +8876,7 @@ fun! s:NetrwTgtMenu()
|
||||
let tgtdict[histentry] = histcnt
|
||||
let ehistentry = escape(histentry,g:netrw_menu_escape)
|
||||
" call Decho("menu: Targets: ".histentry,'~'.expand("<slnum>"))
|
||||
- exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.2.".priority." ".g:NetrwTopLvlMenu.'Targets.'.ehistentry." :call netrw#MakeTgt('".histentry."')\<cr>"
|
||||
+ exe 'sil! menu <silent> '.g:NetrwMenuPriority.".19.2.".priority." ".g:NetrwTopLvlMenu.'Targets.'.ehistentry." :call netrw#MakeTgt(".escape(string(histentry),'|').")\<cr>"
|
||||
endif
|
||||
let histcnt = histcnt + 1
|
||||
endwhile
|
||||
12
vim.spec
12
vim.spec
@ -24,7 +24,7 @@ Summary: The VIM editor
|
||||
URL: http://www.vim.org/
|
||||
Name: vim
|
||||
Version: %{baseversion}.%{patchlevel}
|
||||
Release: 31%{?dist}.1
|
||||
Release: 31%{?dist}.2
|
||||
License: Vim and MIT
|
||||
Source0: ftp://ftp.vim.org/pub/vim/unix/vim-%{baseversion}-%{patchlevel}.tar.bz2
|
||||
Source1: vim.sh
|
||||
@ -224,6 +224,12 @@ Patch3067: 0001-patch-9.2.0735-security-arbitrary-Ex-command-executi.patch
|
||||
# do not use <script> in expand()
|
||||
Patch3068: 0001-patch-9.2.0847-security-vimball-code-execution-via-V.patch
|
||||
|
||||
# RHEL-240376 CVE-2026-73078 code injection in netrw via bookmarks
|
||||
# https://redhat.atlassian.net/browse/RHEL-240376
|
||||
# https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69
|
||||
# stripped src/version.c hunk, adapted path from runtime/pack/dist/opt/netrw/ to runtime/ for vim 8.0
|
||||
Patch3069: 0001-patch-9.2.0840-security-code-injection-in-netrw-via-.patch
|
||||
|
||||
|
||||
# gcc is no longer in buildroot by default
|
||||
BuildRequires: gcc
|
||||
@ -473,6 +479,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
|
||||
%patch -P 3066 -p1 -b .CVE-2026-55693
|
||||
%patch -P 3067 -p1 -b .CVE-2026-59858
|
||||
%patch -P 3068 -p1 -b .CVE-2026-73076
|
||||
%patch -P 3069 -p1 -b .CVE-2026-73078
|
||||
|
||||
|
||||
%build
|
||||
@ -992,6 +999,9 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
|
||||
%{_datadir}/icons/locolor/*/apps/*
|
||||
|
||||
%changelog
|
||||
* Wed Aug 19 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-31.2
|
||||
- CVE-2026-73078 vim: code injection in netrw via bookmarks
|
||||
|
||||
* Sat Aug 15 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:8.0.1763-31.1
|
||||
- CVE-2026-73076 vim: code execution via .VimballRecord file
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user