CVE-2023-35970
📋 TL;DR
CVE-2023-35970 is a heap-based buffer overflow vulnerability in GTKWave's FST file parser that allows arbitrary code execution when a user opens a malicious .fst file. This affects users of GTKWave 3.3.115 who process untrusted waveform data files. The vulnerability specifically targets the chain_table parsing in the FST_BL_VCDATA_DYN_ALIAS2 section.
💻 Affected Systems
- GTKWave
📦 What is this software?
Gtkwave by Tonybybell
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running GTKWave, potentially leading to lateral movement, data theft, or ransomware deployment.
Likely Case
Local privilege escalation or arbitrary code execution in the context of the user opening the malicious file, potentially compromising user data and system integrity.
If Mitigated
Limited impact if file execution is blocked or GTKWave runs in sandboxed/isolated environments with minimal privileges.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious file). Proof-of-concept details are available in the Talos Intelligence report.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.118 or later
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
Restart Required: No
Instructions:
1. Download GTKWave 3.3.118 or later from the official repository. 2. Uninstall the vulnerable version. 3. Install the patched version following platform-specific installation procedures.
🔧 Temporary Workarounds
Restrict .fst file processing
allBlock or restrict processing of .fst files from untrusted sources
Run GTKWave with reduced privileges
allExecute GTKWave with minimal user privileges or in sandboxed environments
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of GTKWave
- Use file integrity monitoring to detect unauthorized .fst file modifications
🔍 How to Verify
Check if Vulnerable:
Check GTKWave version: Run 'gtkwave --version' and verify if version is 3.3.115Check Version:
gtkwave --versionVerify Fix Applied:
After patching, run 'gtkwave --version' and confirm version is 3.3.118 or later📡 Detection & Monitoring
Log Indicators:
- GTKWave crash logs with memory access violations
- Unexpected process termination of GTKWave
Network Indicators:
- Download of .fst files from untrusted sources
SIEM Query:
Process:gtkwave AND (EventID:1000 OR EventID:1001) OR FileExtension:.fst AND SourceIP:External🔗 References
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1789
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1789
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1789
