CVE-2023-36747
📋 TL;DR
CVE-2023-36747 is a heap-based buffer overflow vulnerability in GTKWave's FST file parser. Attackers can exploit this by tricking users into opening malicious .fst files, potentially leading to arbitrary code execution. Users of GTKWave for electronic design automation waveform analysis are primarily affected.
💻 Affected Systems
- GTKWave
📦 What is this software?
Gtkwave by Tonybybell
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the GTKWave process, potentially leading to full system compromise if GTKWave runs with elevated privileges.
Likely Case
Application crash (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
Application crash with no further impact if proper sandboxing or privilege separation is implemented.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious file. Public proof-of-concept exists in vulnerability reports.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.3.118 or later
Vendor Advisory: https://sourceforge.net/p/gtkwave/bugs/43/
Restart Required: No
Instructions:
1. Download latest GTKWave from official source. 2. Uninstall old version. 3. Install patched version. 4. Verify installation with version check.
🔧 Temporary Workarounds
Restrict .fst file handling
allConfigure system to open .fst files with alternative software or restrict execution of GTKWave
User awareness training
allTrain users to only open .fst files from trusted sources
🧯 If You Can't Patch
- Run GTKWave in sandboxed environment with minimal privileges
- Implement application whitelisting to prevent unauthorized GTKWave execution
🔍 How to Verify
Check if Vulnerable:
Check GTKWave version: 'gtkwave --version' or examine installed package versionCheck Version:
gtkwave --versionVerify Fix Applied:
Confirm version is 3.3.118 or higher: 'gtkwave --version | grep -q "3.3.11[8-9]\|3.3.[2-9]\|3.[4-9]"'📡 Detection & Monitoring
Log Indicators:
- GTKWave crash logs
- Application error events mentioning heap corruption or buffer overflow
Network Indicators:
- Unusual .fst file downloads from untrusted sources
SIEM Query:
EventID=1000 OR EventID=1001 AND ProcessName="gtkwave.exe" OR Application="GTKWave" AND (Message CONTAINS "heap" OR Message CONTAINS "buffer" OR Message CONTAINS "overflow")🔗 References
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1793
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1793
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1793
