CVE-2023-36915: Arbitrary Code Execution Vulnerability in GTKWave 3.3.115

Overview

A significant vulnerability, CVE-2023-36915, has been identified in the popular waveform viewer GTKWave version 3.3.115. This application is extensively used in the electronics industry for viewing and debugging digital logic simulations, making it a prime target for cyber attackers. The vulnerability is of a high severity level, underlining the importance of immediate attention and mitigation.
The risk lies in multiple integer overflow vulnerabilities that exist in the FST fstReaderIterBlocks2 chain_table allocation functionality of GTKWave. An attacker can exploit this vulnerability to execute arbitrary code, potentially leading to system compromise or data leakage. The affected users need to be aware of this vulnerability and take immediate steps to mitigate the potential risks.

Vulnerability Summary

CVE ID: CVE-2023-36915
Severity: High (CVSS: 7.8)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

GTKWave | 3.3.115

How the Exploit Works

The vulnerability arises from multiple integer overflow vulnerabilities in the GTKWave’s FST fstReaderIterBlocks2 chain_table allocation functionality. An attacker can craft a malicious .fst file that, when opened by an unsuspecting user, causes an integer overflow. This overflow can lead to an oversized allocation for the `chain_table` array, potentially causing a buffer overflow. The attacker can then exploit this overflow to execute arbitrary code of their choice, thus compromising the system or leading to data leakage.

Conceptual Example Code

In a conceptual scenario, an attacker might craft a malicious .fst file with the following pseudocode:

int main() {
int size = INT_MAX;
chain_table = malloc(size);
if(chain_table == NULL) {
printf("Failed to allocate chain_table\n");
exit(1);
}
// The attacker would then populate the `chain_table` array with malicious code.
}

Upon opening this malicious .fst file, the `chain_table` array would overflow. If the attacker has appropriately crafted the overflow, they could execute arbitrary code, leading to system compromise or data leakage.
To mitigate this vulnerability, users of GTKWave 3.3.115 should apply the vendor patch immediately. If a patch is not yet available, users can use a Web Application Firewall (WAF) or Intrusion Detection System (IDS) as a temporary mitigation measure.