CVE-2023-35992
📋 TL;DR
An integer overflow vulnerability in GTKWave's FST file parser allows memory corruption when processing malicious .fst files. This affects users who open untrusted waveform files with vulnerable 32-bit GTKWave binaries. Attackers could potentially execute arbitrary code or crash the application.
💻 Affected Systems
- GTKWave
📦 What is this software?
Gtkwave by Tonybybell
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise when a user opens a malicious .fst file.
Likely Case
Application crash (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
No impact if users only open trusted files or use patched versions.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file. Proof-of-concept details available in Talos advisory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for updated version (Debian patches available)
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
Restart Required: No
Instructions:
1. Update GTKWave through package manager (apt update && apt upgrade gtkwave). 2. Or compile from patched source. 3. Verify version is post-3.3.115.
🔧 Temporary Workarounds
Use 64-bit binary
allSwitch to 64-bit compiled GTKWave if available, as integer overflow may be less exploitable.
Check binary: file $(which gtkwave) | grep '64-bit'
Restrict file access
allLimit GTKWave to opening only trusted .fst files from known sources.
🧯 If You Can't Patch
- Isolate GTKWave usage to dedicated systems with no sensitive data
- Implement application whitelisting to prevent execution of malicious payloads
🔍 How to Verify
Check if Vulnerable:
Check GTKWave version: gtkwave --version. If version is 3.3.115 or earlier and binary is 32-bit, it's vulnerable.Check Version:
gtkwave --version 2>/dev/null || dpkg -l | grep gtkwave || rpm -q gtkwaveVerify Fix Applied:
Verify updated version and test with known safe .fst files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- GTKWave crash logs
- Segmentation fault errors in system logs
Network Indicators:
- Unusual .fst file downloads from untrusted sources
SIEM Query:
Process:gtkwave AND (EventID:1000 OR Signal:SIGSEGV)🔗 References
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1790
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1790
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1790
