Fix CVE-2026-47162: netrw code injection via NetrwBookHistSave()
Backport upstream commit f08ab2f4d7d2 to fix CVE-2026-47162,
a code injection vulnerability in netrw's NetrwBookHistSave()
function. The fix replaces unsafe string concatenation with
the string() function for safe quoting of directory names
when saving bookmark history. A new test file
(test_plugin_netrw.vim) is included to verify the fix.
CVE: CVE-2026-47162
Upstream patches:
- f08ab2f4d7.patch
Resolves: RHEL-186663
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent
Zdenek Dohnal
parent
e28b8ae4ff
commit
e1c7040ec9
@ -0,0 +1,84 @@
|
||||
From 191a038d82f12d4d55a42c505bf3faa10c22fbe4 Mon Sep 17 00:00:00 2001
|
||||
From: Christian Brabandt <cb@256bit.org>
|
||||
Date: Sun, 17 May 2026 18:53:48 +0000
|
||||
Subject: [PATCH] patch 9.2.0495: [security]: runtime(netrw): code injection
|
||||
via NetrwBookHistSave()
|
||||
|
||||
Problem: [security]: runtime(netrw): code injection via
|
||||
NetrwBookHistSave()
|
||||
Solution: Properly quote the directory name using string() function
|
||||
(Srinivas Piskala Ganesh Babu)
|
||||
|
||||
Github Security Advisory:
|
||||
https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c
|
||||
|
||||
Signed-off-by: Christian Brabandt <cb@256bit.org>
|
||||
---
|
||||
runtime/autoload/netrw.vim | 2 +-
|
||||
src/testdir/Make_all.mak | 2 ++
|
||||
src/testdir/test_plugin_netrw.vim | 23 +++++++++++++++++++++++
|
||||
3 files changed, 26 insertions(+), 1 deletion(-)
|
||||
create mode 100644 src/testdir/test_plugin_netrw.vim
|
||||
|
||||
diff --git a/runtime/autoload/netrw.vim b/runtime/autoload/netrw.vim
|
||||
index 47575ef90..f7a44f35c 100644
|
||||
--- a/runtime/autoload/netrw.vim
|
||||
+++ b/runtime/autoload/netrw.vim
|
||||
@@ -3803,7 +3803,7 @@ fun! s:NetrwBookHistSave()
|
||||
while ( first || cnt != g:netrw_dirhistcnt )
|
||||
let lastline= lastline + 1
|
||||
if exists("g:netrw_dirhist_{cnt}")
|
||||
- call setline(lastline,'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'")
|
||||
+ call setline(lastline,'let g:netrw_dirhist_'.cnt.'='.string(g:netrw_dirhist_{cnt}))
|
||||
" call Decho("..".lastline.'let g:netrw_dirhist_'.cnt."='".g:netrw_dirhist_{cnt}."'",'~'.expand("<slnum>"))
|
||||
endif
|
||||
let first = 0
|
||||
diff --git a/src/testdir/Make_all.mak b/src/testdir/Make_all.mak
|
||||
index 2b3d16d78..2ed089f98 100644
|
||||
--- a/src/testdir/Make_all.mak
|
||||
+++ b/src/testdir/Make_all.mak
|
||||
@@ -229,6 +229,7 @@ NEW_TESTS = \
|
||||
test_perl \
|
||||
test_plugin_ccomplete \
|
||||
+ test_plugin_netrw \
|
||||
test_plugin_phpcomplete \
|
||||
test_plugin_tar \
|
||||
test_plus_arg_edit \
|
||||
test_popup \
|
||||
@@ -482,6 +483,7 @@ NEW_TESTS_RES = \
|
||||
test_perl.res \
|
||||
test_plugin_ccomplete.res \
|
||||
+ test_plugin_netrw.res \
|
||||
test_plugin_phpcomplete.res \
|
||||
test_plugin_tar.res \
|
||||
test_plus_arg_edit.res \
|
||||
test_popup.res \
|
||||
diff --git a/src/testdir/test_plugin_netrw.vim b/src/testdir/test_plugin_netrw.vim
|
||||
new file mode 100644
|
||||
index 000000000..e9d771078
|
||||
--- /dev/null
|
||||
+++ b/src/testdir/test_plugin_netrw.vim
|
||||
@@ -0,0 +1,23 @@
|
||||
+" Tests for the netrw plugin
|
||||
+
|
||||
+func Test_netrw_injection()
|
||||
+ let g:netrw_home = getcwd()
|
||||
+ let savefile = g:netrw_home . '/.netrwhist'
|
||||
+ let g:netrw_dirhistmax = 10
|
||||
+ let g:netrw_dirhistcnt = 1
|
||||
+ let g:netrw_dirhist_1 = "x'|let g:injected = 1|let y='z"
|
||||
+ call delete(savefile)
|
||||
+ try
|
||||
+ call netrw#Call('NetrwBookHistSave')
|
||||
+ call assert_true(filereadable(savefile), savefile . ' must be written')
|
||||
+ unlet g:netrw_dirhist_1
|
||||
+ execute 'source ' . fnameescape(savefile)
|
||||
+ call assert_false(exists("g:injected"), 'injected statement must not execute')
|
||||
+ call assert_equal("x'|let g:injected = 1|let y='z", g:netrw_dirhist_1, 'dirname must round-trip')
|
||||
+ finally
|
||||
+ call delete(savefile)
|
||||
+ unlet! g:netrw_home g:netrw_dirhistmax g:netrw_dirhistcnt g:netrw_dirhist_1 g:injected
|
||||
+ endtry
|
||||
+endfunc
|
||||
+
|
||||
+" vim:ts=8 sts=2 sw=2 et
|
||||
11
vim.spec
11
vim.spec
@ -51,7 +51,7 @@ Summary: The VIM editor
|
||||
URL: http://www.vim.org/
|
||||
Name: vim
|
||||
Version: %{baseversion}.%{patchlevel}
|
||||
Release: 19%{?dist}
|
||||
Release: 20%{?dist}
|
||||
Epoch: 2
|
||||
# swift.vim contains Apache 2.0 with runtime library exception:
|
||||
# which is taken as Apache-2.0 WITH Swift-exception - reported to legal as https://gitlab.com/fedora/legal/fedora-license-data/-/issues/188
|
||||
@ -177,6 +177,10 @@ Patch3028: 0001-runtime-ccomplete-fix-type-mismatch-error.patch
|
||||
# https://redhat.atlassian.net/browse/RHEL-194056
|
||||
# https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7
|
||||
Patch3029: 0001-patch-9.2.0653-security-out-of-bounds-write-in-tree_.patch
|
||||
# RHEL-186663 CVE-2026-47162 code injection via NetrwBookHistSave()
|
||||
# https://redhat.atlassian.net/browse/RHEL-186663
|
||||
# https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b
|
||||
Patch3030: 0001-patch-9.2.0495-security-runtime-netrw-code-injectio.patch
|
||||
|
||||
|
||||
# uses autoconf in spec file
|
||||
@ -524,6 +528,7 @@ perl -pi -e "s,bin/nawk,bin/awk,g" runtime/tools/mve.awk
|
||||
%patch -P 3027 -p1 -b .ccomplete-ex-inject
|
||||
%patch -P 3028 -p1 -b .runtime-ccomplete
|
||||
%patch -P 3029 -p1 -b .tree-count-words-oob
|
||||
%patch -P 3030 -p1 -b .netrw-hist-inject
|
||||
|
||||
%build
|
||||
cd src
|
||||
@ -1154,6 +1159,10 @@ touch %{buildroot}/%{_datadir}/%{name}/vimfiles/doc/tags
|
||||
|
||||
|
||||
%changelog
|
||||
* Wed Aug 05 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-20
|
||||
- RHEL-186663 CVE-2026-47162 vim: code injection via
|
||||
NetrwBookHistSave()
|
||||
|
||||
* Wed Jul 29 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2:9.1.083-19
|
||||
- RHEL-194056 CVE-2026-55693 vim: out-of-bounds write in
|
||||
tree_count_words()
|
||||
|
||||
Loading…
Reference in New Issue
Block a user