CVE-2021-3903: 
NixOS vulnerability analysis and mitigation

CVE-2021-3903 is a heap-based buffer overflow vulnerability affecting the Vim text editor. The vulnerability was discovered in October 2021 and affects various versions of Vim. When exploited, this vulnerability could allow an attacker to cause memory to be read outside of the bounds of the buffer (CVE Mitre, Debian LTS).

The vulnerability occurs when scrolling without a valid screen, leading to invalid memory access. The issue was addressed in patch 8.2.3564 by removing the VALID_BOTLINE flag setting in w_valid (Vim Commit). The vulnerability was assigned a security impact rating of Moderate by Red Hat (Fedora Update).

The vulnerability could result in a segmentation fault or crash by causing memory to be read outside of the bounds of the buffer, potentially leading to a denial-of-service condition (Red Hat CVE).

The vulnerability requires an attacker to trigger specific conditions related to scrolling without a valid screen. No known exploits in the wild have been reported at the time of the vulnerability disclosure (OSS Security).

The vulnerability has been patched in various distributions. Fedora released version 8.2.3568-1 for affected versions (Fedora Update), and Debian included fixes in version 2:8.0.0197-4+deb9u7 (Debian LTS). Users are recommended to upgrade to the patched versions.