CVE-2023-35962
📋 TL;DR
CVE-2023-35962 allows arbitrary command execution through OS command injection in GTKWave's vcd2vzt utility when processing specially crafted wave files. Attackers can achieve remote code execution by tricking users into opening malicious files. This affects anyone using GTKWave 3.3.115 to analyze electronic design automation waveforms.
💻 Affected Systems
- GTKWave
📦 What is this software?
Gtkwave by Tonybybell
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running GTKWave, potentially leading to lateral movement, data exfiltration, or ransomware deployment.
Likely Case
Local privilege escalation or execution of arbitrary commands in the context of the user opening the malicious file, potentially compromising sensitive engineering data.
If Mitigated
Limited impact if running with minimal privileges, in isolated environments, or with proper file validation controls.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file. Proof of concept details available in Talos Intelligence reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 3.3.115
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
Restart Required: No
Instructions:
1. Check current GTKWave version. 2. Update to latest version from official repository. 3. Verify vcd2vzt utility is updated. 4. Test with known safe waveform files.
🔧 Temporary Workarounds
Disable vcd2vzt utility
linuxRemove or restrict execute permissions on the vulnerable vcd2vzt binary
sudo chmod -x /usr/bin/vcd2vzt
sudo mv /usr/bin/vcd2vzt /usr/bin/vcd2vzt.disabled
Restrict file sources
allOnly open waveform files from trusted sources and validate file integrity
🧯 If You Can't Patch
- Run GTKWave with minimal user privileges (non-admin/non-root)
- Use application sandboxing or containerization to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check if GTKWave version is 3.3.115: gtkwave --versionCheck Version:
gtkwave --version | head -1Verify Fix Applied:
Confirm version is newer than 3.3.115 and test with sample waveform files📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from GTKWave context
- Suspicious command-line arguments to vcd2vzt
Network Indicators:
- Unexpected outbound connections from GTKWave process
SIEM Query:
process_name:vcd2vzt AND (command_line:*sh* OR command_line:*bash* OR command_line:*cmd*)🔗 References
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1786
