CVE-2023-35956
📋 TL;DR
This vulnerability allows arbitrary code execution when a user opens a malicious .fst file in GTKWave. Attackers can exploit heap-based buffer overflows in the fstReaderIterBlocks2 VCDATA parsing functionality to gain control of the victim's system. Anyone using GTKWave to open untrusted .fst files is affected.
💻 Affected Systems
- GTKWave
📦 What is this software?
Gtkwave by Tonybybell
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running GTKWave, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or arbitrary code execution in the context of the user opening the malicious file, enabling data exfiltration or further attacks.
If Mitigated
No impact if users only open trusted .fst files or if the application is sandboxed/run with minimal privileges.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious file). No public proof-of-concept has been identified, but the vulnerability details are publicly disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Debian security updates or upstream GTKWave repository for patched versions
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
Restart Required: No
Instructions:
1. Update GTKWave through your package manager (apt update && apt upgrade gtkwave on Debian/Ubuntu). 2. For source installations, download and compile the latest version from the official repository. 3. Verify the update was successful by checking the version.
🔧 Temporary Workarounds
Restrict .fst file handling
allConfigure system to only allow trusted .fst files to be opened with GTKWave
Run GTKWave with reduced privileges
linuxExecute GTKWave in a sandboxed environment or with minimal user permissions
sudo -u nobody gtkwave
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of GTKWave
- Use file integrity monitoring to detect unauthorized .fst files
🔍 How to Verify
Check if Vulnerable:
Check GTKWave version: gtkwave --version. If version is 3.3.115 or earlier, the system is likely vulnerable.Check Version:
gtkwave --versionVerify Fix Applied:
After updating, run gtkwave --version to confirm version has changed from 3.3.115. Test with known safe .fst files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Unexpected crashes of GTKWave process
- Memory access violation errors in system logs
Network Indicators:
- Unusual outbound connections from GTKWave process
SIEM Query:
Process:gtkwave AND (EventID:1000 OR EventID:1001) OR FileExtension:.fst AND ProcessCreation🔗 References
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1785
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1785
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1785
