19

I use vim and have a use case for modelines. A modeline means that vim will parse a textfile for lines like:

# vim: set someoption=somevalue

and will then set those options. This is awesome if I'm the person writing the modelines, but it also might break down the assumption that I can open untrusted text files with my text editor with no harm.

Assume that I'm running an updated version of vim. Assume that I don't mind if someone can set annoying options that make things look bad (eg, messing with the tabwidth). What could a malicious text file do?

Thanks!

  • Ideally not a lot, but in practice it's not as ideal as the ideal would suggest. Just search for vim modeline vulnerability for a few examples of how this has gone wrong in the past. This is part of why modeline support is by default disabled if you're running vim as root. – tylerl May 16 '13 at 4:16
12

Although in theory modelines shouldn't allow you to do anything bad, sanitizing modeline functions input is hard. There have been several security issues in the past that allowed arbitrary command execution or DoS attacks. To cite a few past vulnerabilities I could find:

While I believe they have all been fixed, new vulnerabilities keep popping up and it is likely that similar vulnerabilities will be found in the future, which is why distros disable modelines by default (at least Debian and SuSE do).

  • 1
    CVE-2019-12735 is another one as of 2016-06-11, – Joe McMahon Jun 11 at 23:42
  • @JoeMcMahon thanks, added! – Calimo Jun 12 at 6:27
  • It is fundamentally impossible to guarantee that all modeline-related security vulnerabilities have ever been "completely" :-) fixed so long as it is still possible to include embedded instructions to be executed by the code looking at the data in the very data itself. This is why the documentation for Keith Bostic's nvi has always said of modelines that the option is unimplemented and that it never will be. This is just like all the security bugs stemming from file-embedded commands or macro instructions to run in PDF, Word, Excel, &c&c&c. – tchrist Jun 17 at 19:13
1

Vim modelines have in the past had arbitrary code execution bugs.
So they could do a lot of harm in the past.

First noticed in 6.3, fixed, some similar vulns found later.

Since the risk is inherent, (mixing data and code), modelines are generally disabled for root.

The way I understand it, previous bugs were fixed, so except for unpublished issues, using modern Vim it is safe to open un-trusted files with modelines on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.