CVE-2023-35964
📋 TL;DR
This CVE allows arbitrary command execution through OS command injection in GTKWave's vcd2lxt utility when processing specially crafted wave files. Attackers can achieve remote code execution by tricking users into opening malicious files. Users of GTKWave 3.3.115 who process untrusted wave files are affected.
💻 Affected Systems
- GTKWave
📦 What is this software?
Gtkwave by Tonybybell
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running GTKWave, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or arbitrary command execution in the context of the user opening the malicious file, potentially leading to data exfiltration or malware installation.
If Mitigated
Limited impact if running with minimal privileges, in sandboxed environments, or with proper file validation controls.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file); detailed technical analysis available in Talos reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.116 or later
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
Restart Required: No
Instructions:
1. Check current GTKWave version. 2. Update to version 3.3.116 or later from official repositories. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable vcd2lxt utility
linuxRemove or restrict execute permissions on the vcd2lxt binary to prevent exploitation.
sudo chmod -x /usr/bin/vcd2lxt
Use file validation
allImplement strict file validation and only open wave files from trusted sources.
🧯 If You Can't Patch
- Run GTKWave with minimal user privileges (non-root/non-admin)
- Use application sandboxing or containerization to limit potential damage
🔍 How to Verify
Check if Vulnerable:
Check if GTKWave version is 3.3.115: 'gtkwave --version' or 'vcd2lxt --version'Check Version:
gtkwave --versionVerify Fix Applied:
Confirm version is 3.3.116 or later: 'gtkwave --version'📡 Detection & Monitoring
Log Indicators:
- Unusual process execution from GTKWave or vcd2lxt
- Suspicious command-line arguments passed to vcd2lxt
Network Indicators:
- Unexpected outbound connections from GTKWave processes
SIEM Query:
Process creation where parent process contains 'gtkwave' or 'vcd2lxt' and command line contains suspicious patterns like ';', '|', '&', or '`'🔗 References
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1786
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1786
