oss-security - [vim-security] Insecure Socket Directory in Vim

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <avDZp5byq7MFFZaM@256bit.org>
Date: Sun, 8 Nov 2026 21:20:55 +0100
From: Christian Brabandt <cb@...bit.org>
To: oss-security@...ts.openwall.com
Subject: [vim-security] Insecure Socket Directory in Vim < 9.2.1308

Insecure Socket Directory in Vim < 9.2.1308
===========================================
Date: 08.11.2026
Severity: Medium
CVE: *requested, not yet assigned*
CWE: Unverified Ownership (CWE-283), Incorrect Default Permissions (CWE-276)

## Summary
When using the socketserver backend of the clientserver feature, Vim places
its socket in a per-user directory such as `/tmp/vim-<uid>`.  An existing
directory was used without checking its owner or permissions, and the socket
was created with the user's umask.  A local attacker can pre-create this
directory and then connect to or replace the victim's server socket, which
allows evaluating arbitrary Vim expressions in the victim's Vim.

## Description
`socketserver_get_path()` creates the socket directory
`$XDG_RUNTIME_DIR/vim` or `$TMPDIR/vim-<uid>` (`/tmp` if `$TMPDIR` is unset)
using:

    if (vim_mkdir(buf, 0700) == -1 && errno != EEXIST)
        continue;

If the directory already exists, it is used as-is.  Since `/tmp` is
world-writable, another user can create `/tmp/vim-<uid>` for the victim's
uid beforehand, owned by the attacker and with permissive mode.
`channel_listen_unix()` then binds the server socket inside that directory
with permissions `0777 & ~umask`.  The socketserver does not authenticate
connecting clients and evaluates "expr" messages using
`eval_client_expr_to_string()`, and "keystrokes" messages are inserted into
the input buffer.

With a permissive umask (e.g. `002` or `000`) the attacker can connect to the
socket directly.  With the common umask `022` a direct connect fails, but
since the attacker owns the directory, they can still remove or replace the
socket and impersonate the server towards clients.

## Impact
Arbitrary Vim expression evaluation, and therefore arbitrary shell command
execution, in the context of the user running Vim, on multi-user systems.

Exploitation requires:

* a Vim build with the `+socketserver` feature, used as server (e.g. using
  `--servername` or with `+autoservername`),
* the attacker having a local account on the same system,
* the socket directory being located in a shared directory such as `/tmp`
  (`$XDG_RUNTIME_DIR` is not affected, since it is only accessible by the
  user),
* for direct code execution: a umask that makes the socket accessible by
  the attacker.

## Acknowledgements
The Vim project would like to thank Calif.io and 360AlphaLab for independently
reporting the issue.

## References
The issue has been fixed as of Vim patch [v9.2.1308](https://github.com/vim/vim/releases/tag/v9.2.1308).

- [Commit](https://github.com/vim/vim/commit/a448e0c6bc459d7dbeab581bcb76a0d)
- [Github Security Advisory](https://github.com/vim/vim/security/advisories/GHSA-p99j-mfjp-r4cg)

Thanks,
Christian
-- 
Das Glück kann nicht wie ein mathematischer Lehrsatz bewiesen werden,
es muß empfunden werden, wenn es da sein soll.
		-- Heinrich von Kleist

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.