CVE-2022-1629: 
NixOS vulnerability analysis and mitigation

A buffer over-read vulnerability was discovered in the findnextquote function in GitHub repository vim/vim prior to version 8.2.4925. The vulnerability was assigned CVE-2022-1629 and was disclosed in May 2022. This vulnerability affects Vim text editor installations across multiple operating systems and distributions (NVD, Debian).

The vulnerability is classified as a Buffer Over-read (CWE-126) issue in the findnextquote function. When processing text with trailing backslashes, the function could read beyond the end of the line, potentially leading to software crashes, memory modification, and possible remote code execution. The vulnerability received a CVSS v3.1 base score of 7.8 (HIGH) according to NVD's assessment, with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow attackers to cause program crashes, modify memory, and potentially achieve remote code execution through specially crafted input. The impact affects the confidentiality, integrity, and availability of the system running the vulnerable Vim version (NVD).

The vulnerability was patched in Vim version 8.2.4925. The fix involves adding improved checks for NUL after backslash characters in the findnextquote function. Users are advised to upgrade to this version or later. Multiple distributions have released security updates to address this vulnerability, including Fedora, Gentoo, and Apple macOS (Fedora Update, Gentoo Advisory).