CVE-2023-35704
📋 TL;DR
This vulnerability allows arbitrary code execution when a user opens a malicious .fst file in GTKWave. Attackers can exploit stack-based buffer overflows in the FST LEB128 varint functionality to gain control of the victim's system. Anyone using GTKWave to open untrusted waveform files is affected.
💻 Affected Systems
- GTKWave
📦 What is this software?
Gtkwave by Tonybybell
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running GTKWave, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or arbitrary code execution in the context of the user opening the malicious file, enabling data access and further system exploitation.
If Mitigated
Limited impact if file opening is restricted to trusted sources and GTKWave runs with minimal privileges.
🎯 Exploit Status
Exploitation requires crafting a malicious .fst file and convincing a user to open it. The vulnerability is in file parsing code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.3.115 (check GTKWave releases)
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
Restart Required: No
Instructions:
1. Visit GTKWave official website or package repository. 2. Download and install the latest version. 3. Verify the version is newer than 3.3.115.
🔧 Temporary Workarounds
Restrict .fst file sources
allOnly open .fst files from trusted, verified sources. Implement file validation policies.
Run GTKWave with reduced privileges
linuxExecute GTKWave with limited user permissions to minimize impact if exploited.
sudo -u lowprivilegeuser gtkwave
🧯 If You Can't Patch
- Discontinue use of GTKWave for untrusted .fst files
- Implement application whitelisting to block GTKWave execution
🔍 How to Verify
Check if Vulnerable:
Check GTKWave version: 'gtkwave --version' or similar command. If version is 3.3.115 or earlier, it's vulnerable.Check Version:
gtkwave --versionVerify Fix Applied:
After updating, run 'gtkwave --version' to confirm version is newer than 3.3.115.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from GTKWave
- Crash logs from GTKWave with memory corruption errors
Network Indicators:
- Outbound connections from GTKWave process (unusual for this application)
SIEM Query:
Process:gtkwave AND (EventID:1000 OR EventID:1001) OR Process:gtkwave AND NetworkConnection🔗 References
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1783
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1783
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1783
