CVE-2023-36864
📋 TL;DR
This integer overflow vulnerability in GTKWave's FST file parser allows arbitrary code execution when a user opens a specially crafted malicious .fst file. Attackers can exploit this to gain control of the victim's system. Anyone using GTKWave to open untrusted FST files is affected.
💻 Affected Systems
- GTKWave
📦 What is this software?
Gtkwave by Tonybybell
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the user running GTKWave, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Local privilege escalation or arbitrary code execution in the context of the user opening the malicious file, enabling data access and further system exploitation.
If Mitigated
No impact if users only open trusted FST files from verified sources or if the application is patched.
🎯 Exploit Status
Exploitation requires user interaction (opening a malicious file). The vulnerability is well-documented with technical details available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with distribution maintainers - Debian has patched versions available
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
Restart Required: No
Instructions:
1. Update GTKWave through your package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt upgrade gtkwave. 3. For other systems, check with your distribution's security updates.
🔧 Temporary Workarounds
Restrict FST file handling
allConfigure system to open FST files only with trusted applications or in sandboxed environments
User awareness training
allTrain users to only open FST files from trusted sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unapproved GTKWave binaries
- Use sandboxing solutions to run GTKWave in isolated environments when processing untrusted files
🔍 How to Verify
Check if Vulnerable:
Check GTKWave version: gtkwave --version. If version is 3.3.115 or earlier, assume vulnerable.Check Version:
gtkwave --versionVerify Fix Applied:
Verify updated version: gtkwave --version should show a version after 3.3.115 or a patched distribution version.📡 Detection & Monitoring
Log Indicators:
- GTKWave crash logs with memory corruption errors
- Unexpected process creation from GTKWave
Network Indicators:
- Unusual outbound connections from GTKWave process
SIEM Query:
Process creation where parent process is gtkwave AND (command line contains .fst OR file extension is .fst)🔗 References
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1797
- https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2023-1797
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1797
