CVE-2022-23947
📋 TL;DR
A stack-based buffer overflow vulnerability in KiCad's Gerber/Excellon file parsers allows remote code execution when processing malicious files. Users who open untrusted Gerber or Excellon files with vulnerable KiCad versions are affected. This could lead to complete system compromise.
💻 Affected Systems
- KiCad EDA
📦 What is this software?
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full code execution on victim's system, potentially leading to complete system takeover, data theft, or lateral movement.
Likely Case
Attacker tricks user into opening malicious Gerber/Excellon file, leading to arbitrary code execution with user privileges.
If Mitigated
With proper file validation and user awareness, risk reduces to minimal as users avoid opening untrusted files.
🎯 Exploit Status
Exploitation requires user to open malicious file; no authentication needed. Public PoC exists in Talos advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: KiCad 6.0.2 and later
Vendor Advisory: https://www.kicad.org/
Restart Required: No
Instructions:
1. Download KiCad 6.0.2 or later from official website. 2. Install over existing version. 3. Verify installation with version check.
🔧 Temporary Workarounds
Disable Gerber/Excellon file parsing
allRemove or restrict KiCad's ability to parse Gerber/Excellon files
Not applicable - requires application configuration changes
File type validation
allImplement strict file validation before opening in KiCad
Not applicable - requires external validation tools
🧯 If You Can't Patch
- Restrict KiCad usage to trusted files only; implement strict file validation procedures
- Isolate KiCad installations; run with minimal privileges; monitor for suspicious file openings
🔍 How to Verify
Check if Vulnerable:
Check KiCad version: if version is 6.0.1 or earlier, system is vulnerableCheck Version:
kicad --version (Linux/macOS) or check About in KiCad GUI (Windows)Verify Fix Applied:
Verify KiCad version is 6.0.2 or later after patching📡 Detection & Monitoring
Log Indicators:
- KiCad crash logs with stack overflow errors
- Unexpected process creation from KiCad
Network Indicators:
- Outbound connections from KiCad process to unexpected destinations
SIEM Query:
Process Creation where Parent Process contains 'kicad' AND Command Line contains suspicious patterns🔗 References
- https://lists.debian.org/debian-lts-announce/2022/05/msg00009.html
- https://lists.debian.org/debian-lts-announce/2022/08/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EMCGSSP3FIWCSL2KXVXLF35JYZKZE5Q/
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1460
- https://www.debian.org/security/2022/dsa-5214
- https://lists.debian.org/debian-lts-announce/2022/05/msg00009.html
- https://lists.debian.org/debian-lts-announce/2022/08/msg00010.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5EMCGSSP3FIWCSL2KXVXLF35JYZKZE5Q/
- https://talosintelligence.com/vulnerability_reports/TALOS-2022-1460
- https://www.debian.org/security/2022/dsa-5214
