CVE-2017-17087: Exposure of Resource to Wrong Sphere (CWE-668)
value: fileio.c in Vim prior to 8.0.1263 sets the group ownership of a .swp file to the editor's primary group (which may be different from the group ownership of the original file), which allows local users to obtain sensitive information by leveraging an applicable group membership, as demonstrated by /etc/shadow owned by root:shadow mode 0640, but /etc/.shadow.swp owned by root:users mode 0640, a different vulnerability than CVE-2017-1000382.
CWE description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CVSS v3 base score: 5.5
Published: 2017-12-01T08:29Z
Repository: https://github.com/vim/vim
Language: C
Files changed: src/Makefile, src/fileio.c, src/testdir/test_swap.vim, src/version.c
Commit date: 2017-11-04 21:35:01 +0100
Commit message: patch 8.0.1263: others can read the swap file if a user is careless

Problem:    Others can read the swap file if a user is careless with his
            primary group.
Solution:   If the group permission allows for reading but the world
            permissions doesn't, make sure the group is right.

Diff: diff --git a/src/Makefile b/src/Makefile
index e55e830ef..48487aad5 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -2257,10 +2257,11 @@ test_arglist \
 	test_startup \
 	test_startup_utf8 \
 	test_stat \
 	test_statusline \
 	test_substitute \
+	test_swap \
 	test_syn_attr \
 	test_syntax \
 	test_system \
 	test_tabline \
 	test_tabpage \
diff --git a/src/fileio.c b/src/fileio.c
index 87b85cf38..34dcdb6b5 100644
--- a/src/fileio.c
+++ b/src/fileio.c
@@ -714,11 +714,33 @@ readfile(
 #endif
 #ifdef UNIX
 	/* Set swap file protection bits after creating it. */
 	if (swap_mode > 0 && curbuf->b_ml.ml_mfp != NULL
 			  && curbuf->b_ml.ml_mfp->mf_fname != NULL)
-	    (void)mch_setperm(curbuf->b_ml.ml_mfp->mf_fname, (long)swap_mode);
+	{
+	    char_u *swap_fname = curbuf->b_ml.ml_mfp->mf_fname;
+
+	    /*
+	     * If the group-read bit is set but not the world-read bit, then
+	     * the group must be equal to the group of the original file.  If
+	     * we can't make that happen then reset the group-read bit.  This
+	     * avoids making the swap file readable to more users when the
+	     * primary group of the user is too permissive.
+	     */
+	    if ((swap_mode & 044) == 040)
+	    {
+		stat_T	swap_st;
+
+		if (mch_stat((char *)swap_fname, &swap_st) >= 0
+			&& st.st_gid != swap_st.st_gid
+			&& fchown(curbuf->b_ml.ml_mfp->mf_fd, -1, st.st_gid)
+									 == -1)
+		    swap_mode &= 0600;
+	    }
+
+	    (void)mch_setperm(swap_fname, (long)swap_mode);
+	}
 #endif
     }
 
 #if defined(HAS_SWAP_EXISTS_ACTION)
     /* If "Quit" selected at ATTENTION dialog, don't load the file */
diff --git a/src/testdir/test_swap.vim b/src/testdir/test_swap.vim
index 245e1f18b..d11c124d0 100644
--- a/src/testdir/test_swap.vim
+++ b/src/testdir/test_swap.vim
@@ -1,48 +1,82 @@
 " Tests for the swap feature
 
-" Tests for 'directory' option.
-func Test_swap_directory()
+"" Tests for 'directory' option.
+"func Test_swap_directory()
+"  if !has("unix")
+"    return
+"  endif
+"  let content = ['start of testfile',
+"	      \ 'line 2 Abcdefghij',
+"	      \ 'line 3 Abcdefghij',
+"	      \ 'end of testfile']
+"  call writefile(content, 'Xtest1')
+"
+"  "  '.', swap file in the same directory as file
+"  set dir=.,~
+"
+"  " Verify that the swap file doesn't exist in the current directory
+"  call assert_equal([], glob(".Xtest1*.swp", 1, 1, 1))
+"  edit Xtest1
+"  let swfname = split(execute("swapname"))[0]
+"  call assert_equal([swfname], glob(swfname, 1, 1, 1))
+"
+"  " './dir', swap file in a directory relative to the file
+"  set dir=./Xtest2,.,~
+"
+"  call mkdir("Xtest2")
+"  edit Xtest1
+"  call assert_equal([], glob(swfname, 1, 1, 1))
+"  let swfname = "Xtest2/Xtest1.swp"
+"  call assert_equal(swfname, split(execute("swapname"))[0])
+"  call assert_equal([swfname], glob("Xtest2/*", 1, 1, 1))
+"
+"  " 'dir', swap file in directory relative to the current dir
+"  set dir=Xtest.je,~
+"
+"  call mkdir("Xtest.je")
+"  call writefile(content, 'Xtest2/Xtest3')
+"  edit Xtest2/Xtest3
+"  call assert_equal(["Xtest2/Xtest3"], glob("Xtest2/*", 1, 1, 1))
+"  let swfname = "Xtest.je/Xtest3.swp"
+"  call assert_equal(swfname, split(execute("swapname"))[0])
+"  call assert_equal([swfname], glob("Xtest.je/*", 1, 1, 1))
+"
+"  set dir&
+"  call delete("Xtest1")
+"  call delete("Xtest2", "rf")
+"  call delete("Xtest.je", "rf")
+"endfunc
+
+func Test_swap_group()
   if !has("unix")
     return
   endif
-  let content = ['start of testfile',
-	      \ 'line 2 Abcdefghij',
-	      \ 'line 3 Abcdefghij',
-	      \ 'end of testfile']
-  call writefile(content, 'Xtest1')
-
-  "  '.', swap file in the same directory as file
-  set dir=.,~
-
-  " Verify that the swap file doesn't exist in the current directory
-  call assert_equal([], glob(".Xtest1*.swp", 1, 1, 1))
-  edit Xtest1
-  let swfname = split(execute("swapname"))[0]
-  call assert_equal([swfname], glob(swfname, 1, 1, 1))
-
-  " './dir', swap file in a directory relative to the file
-  set dir=./Xtest2,.,~
-
-  call mkdir("Xtest2")
-  edit Xtest1
-  call assert_equal([], glob(swfname, 1, 1, 1))
-  let swfname = "Xtest2/Xtest1.swp"
-  call assert_equal(swfname, split(execute("swapname"))[0])
-  call assert_equal([swfname], glob("Xtest2/*", 1, 1, 1))
+  let groups = split(system('groups'))
+  if len(groups) <= 1
+    throw 'Skipped: need at least two groups, got ' . groups
+  endif
 
-  " 'dir', swap file in directory relative to the current dir
-  set dir=Xtest.je,~
+  call delete('Xtest')
+  split Xtest
+  call setline(1, 'just some text')
+  wq
+  if system('ls -l Xtest') !~ ' ' . groups[0] . ' \d'
+    throw 'Skipped: test file does not have the first group'
+  else
+    silent !chmod 640 Xtest
+    call system('chgrp ' . groups[1] . ' Xtest')
+    if system('ls -l Xtest') !~ ' ' . groups[1] . ' \d'
+      throw 'Skipped: cannot set second group on test file'
+    else
+      split Xtest
+      let swapname = substitute(execute('swapname'), '[[:space:]]', '', 'g')
+      call assert_match('Xtest', swapname)
+      " Group of swapfile must now match original file.
+      call assert_match(' ' . groups[1] . ' \d', system('ls -l ' . swapname))
 
-  call mkdir("Xtest.je")
-  call writefile(content, 'Xtest2/Xtest3')
-  edit Xtest2/Xtest3
-  call assert_equal(["Xtest2/Xtest3"], glob("Xtest2/*", 1, 1, 1))
-  let swfname = "Xtest.je/Xtest3.swp"
-  call assert_equal(swfname, split(execute("swapname"))[0])
-  call assert_equal([swfname], glob("Xtest.je/*", 1, 1, 1))
+      bwipe!
+    endif
+  endif
 
-  set dir&
-  call delete("Xtest1")
-  call delete("Xtest2", "rf")
-  call delete("Xtest.je", "rf")
+  call delete('Xtest')
 endfunc
diff --git a/src/version.c b/src/version.c
index b7cb58be4..2a2cefe3d 100644
--- a/src/version.c
+++ b/src/version.c
@@ -759,10 +759,12 @@ static char *(features[]) =
 	NULL
 };
 
 static int included_patches[] =
 {   /* Add new patch number below this line */
+/**/
+    1263,
 /**/
     1262,
 /**/
     1261,
 /**/

Vulnerable code: 	    (void)mch_setperm(curbuf->b_ml.ml_mfp->mf_fname, (long)swap_mode);
" Tests for 'directory' option.
func Test_swap_directory()
  let content = ['start of testfile',
	      \ 'line 2 Abcdefghij',
	      \ 'line 3 Abcdefghij',
	      \ 'end of testfile']
  call writefile(content, 'Xtest1')

  "  '.', swap file in the same directory as file
  set dir=.,~

  " Verify that the swap file doesn't exist in the current directory
  call assert_equal([], glob(".Xtest1*.swp", 1, 1, 1))
  edit Xtest1
  let swfname = split(execute("swapname"))[0]
  call assert_equal([swfname], glob(swfname, 1, 1, 1))

  " './dir', swap file in a directory relative to the file
  set dir=./Xtest2,.,~

  call mkdir("Xtest2")
  edit Xtest1
  call assert_equal([], glob(swfname, 1, 1, 1))
  let swfname = "Xtest2/Xtest1.swp"
  call assert_equal(swfname, split(execute("swapname"))[0])
  call assert_equal([swfname], glob("Xtest2/*", 1, 1, 1))
  " 'dir', swap file in directory relative to the current dir
  set dir=Xtest.je,~
  call mkdir("Xtest.je")
  call writefile(content, 'Xtest2/Xtest3')
  edit Xtest2/Xtest3
  call assert_equal(["Xtest2/Xtest3"], glob("Xtest2/*", 1, 1, 1))
  let swfname = "Xtest.je/Xtest3.swp"
  call assert_equal(swfname, split(execute("swapname"))[0])
  call assert_equal([swfname], glob("Xtest.je/*", 1, 1, 1))
  set dir&
  call delete("Xtest1")
  call delete("Xtest2", "rf")
  call delete("Xtest.je", "rf")
Fixed code: 	test_swap \
	{
	    char_u *swap_fname = curbuf->b_ml.ml_mfp->mf_fname;

	    /*
	     * If the group-read bit is set but not the world-read bit, then
	     * the group must be equal to the group of the original file.  If
	     * we can't make that happen then reset the group-read bit.  This
	     * avoids making the swap file readable to more users when the
	     * primary group of the user is too permissive.
	     */
	    if ((swap_mode & 044) == 040)
	    {
		stat_T	swap_st;

		if (mch_stat((char *)swap_fname, &swap_st) >= 0
			&& st.st_gid != swap_st.st_gid
			&& fchown(curbuf->b_ml.ml_mfp->mf_fd, -1, st.st_gid)
									 == -1)
		    swap_mode &= 0600;
	    }

	    (void)mch_setperm(swap_fname, (long)swap_mode);
	}
"" Tests for 'directory' option.
"func Test_swap_directory()
"  if !has("unix")
"    return
"  endif
"  let content = ['start of testfile',
"	      \ 'line 2 Abcdefghij',
"	      \ 'line 3 Abcdefghij',
"	      \ 'end of testfile']
"  call writefile(content, 'Xtest1')
"
"  "  '.', swap file in the same directory as file
"  set dir=.,~
"
"  " Verify that the swap file doesn't exist in the current directory
"  call assert_equal([], glob(".Xtest1*.swp", 1, 1, 1))
"  edit Xtest1
"  let swfname = split(execute("swapname"))[0]
"  call assert_equal([swfname], glob(swfname, 1, 1, 1))
"
"  " './dir', swap file in a directory relative to the file
"  set dir=./Xtest2,.,~
"
"  call mkdir("Xtest2")
"  edit Xtest1
"  call assert_equal([], glob(swfname, 1, 1, 1))
"  let swfname = "Xtest2/Xtest1.swp"
"  call assert_equal(swfname, split(execute("swapname"))[0])
"  call assert_equal([swfname], glob("Xtest2/*", 1, 1, 1))
"
"  " 'dir', swap file in directory relative to the current dir
"  set dir=Xtest.je,~
"
"  call mkdir("Xtest.je")
"  call writefile(content, 'Xtest2/Xtest3')
"  edit Xtest2/Xtest3
"  call assert_equal(["Xtest2/Xtest3"], glob("Xtest2/*", 1, 1, 1))
"  let swfname = "Xtest.je/Xtest3.swp"
"  call assert_equal(swfname, split(execute("swapname"))[0])
"  call assert_equal([swfname], glob("Xtest.je/*", 1, 1, 1))
"
"  set dir&
"  call delete("Xtest1")
"  call delete("Xtest2", "rf")
"  call delete("Xtest.je", "rf")
"endfunc

func Test_swap_group()
  let groups = split(system('groups'))
  if len(groups) <= 1
    throw 'Skipped: need at least two groups, got ' . groups
  endif
  call delete('Xtest')
  split Xtest
  call setline(1, 'just some text')
  wq
  if system('ls -l Xtest') !~ ' ' . groups[0] . ' \d'
    throw 'Skipped: test file does not have the first group'
  else
    silent !chmod 640 Xtest
    call system('chgrp ' . groups[1] . ' Xtest')
    if system('ls -l Xtest') !~ ' ' . groups[1] . ' \d'
      throw 'Skipped: cannot set second group on test file'
    else
      split Xtest
      let swapname = substitute(execute('swapname'), '[[:space:]]', '', 'g')
      call assert_match('Xtest', swapname)
      " Group of swapfile must now match original file.
      call assert_match(' ' . groups[1] . ' \d', system('ls -l ' . swapname))
      bwipe!
    endif
  endif
  call delete('Xtest')
/**/
    1263,