CVE-2023-35702
📋 TL;DR
This CVE describes multiple stack-based buffer overflow vulnerabilities in GTKWave's FST LEB128 varint parsing functionality. Attackers can craft malicious .fst files that, when opened by victims, could lead to arbitrary code execution. Users of GTKWave 3.3.115 who open untrusted .fst files are affected.
💻 Affected Systems
- GTKWave
📦 What is this software?
Gtkwave by Tonybybell
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution with the privileges of the GTKWave user, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Application crash (denial of service) or limited code execution within the GTKWave process context, potentially allowing file system access or further privilege escalation.
If Mitigated
Application crash with no code execution if exploit fails or if memory protections (ASLR, DEP) are effective.
🎯 Exploit Status
Exploitation requires user interaction (opening a file). No public exploit code is mentioned in the references, but technical details are available in the Talos report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check GTKWave updates or Debian security updates (referenced in advisory)
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
Restart Required: Yes
Instructions:
1. Update GTKWave to the latest version from the official source or package manager. 2. For Debian systems, apply security updates via 'apt update && apt upgrade'. 3. Restart any running GTKWave instances after update.
🔧 Temporary Workarounds
Restrict .fst file handling
allConfigure system to open .fst files only with trusted applications or in sandboxed environments.
User awareness training
allTrain users to only open .fst files from trusted sources and verify file integrity.
🧯 If You Can't Patch
- Disable or uninstall GTKWave if not essential
- Use application whitelisting to prevent GTKWave execution
🔍 How to Verify
Check if Vulnerable:
Check GTKWave version: 'gtkwave --version' or check installed package version in package manager.Check Version:
gtkwave --versionVerify Fix Applied:
Verify updated version is installed and no longer 3.3.115. Test with known safe .fst files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- GTKWave crash logs, unexpected process termination, abnormal memory access errors in system logs
Network Indicators:
- Unusual outbound connections from GTKWave process post-file opening
SIEM Query:
Process:gtkwave AND (EventID:1000 OR EventID:1001) OR FileExtension:.fst AND ProcessCreation🔗 References
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1783
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1783
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1783
