CVE-2024-5742

What it actually does

The flaw permits a local attacker to replace an emergency save file created by the editor with a malicious symlink; when the editor is terminated abruptly the file is written using the privileges of the running user, enabling the symlink to redirect the write and potentially overwrite or create files with elevated privileges.

Why it matters to the business

Attackers on the same system can gain unauthorized control over files or processes, leading to full compromise of user accounts or escalation to higher privileges; while not yet seen in ransomware the issue affects any environment running the vulnerable editor and increases operational risk until fixed.

How an attack unfolds

An attacker first creates a symlink in a world-writable directory pointing to a sensitive target file; the victim user then runs the editor on a file and is killed before saving, triggering the emergency file write that follows the attacker-controlled symlink and performs the privileged operation.

How to fix it

Upgrade to a version containing commit c1eb2ddf0f8075faddc5f7c3d39feae3e8e9d6b4 or later; until the update can be applied avoid running the editor with elevated privileges and ensure temporary directories have appropriate permissions.

How to confirm the fix worked

Confirm the installed binary or source matches a fixed commit hash; review process termination handling and temporary-file creation logic in the editor code to verify symlink-safe behavior.

Typical attack path

1. Create a symlink from the expected emergency filename to a privileged target
2. Wait for or induce the editor process to be killed while editing
3. Trigger the emergency-save code path that writes using the running user's permissions
4. Leverage the resulting file modification or creation for further privilege escalation

How to detect it

Review system logs for editor processes that terminated abnormally; inspect temporary directories for unexpected symlinks created around the time of editor crashes or kills; correlate file ownership changes on sensitive targets with editor emergency-save events.

What your security team should do

• Apply the listed fixed commit immediately on all affected systems
• Scan for any locally compiled or packaged instances of the editor
• Add monitoring for unexpected symlink creation in editor temporary directories
• Restrict use of the editor under privileged accounts until patched