CVE-2023-37574: Use-After-Free Vulnerabilities in GTKWave 3.3.115

Overview

The CVE-2023-37574 is a critical vulnerability that affects GTKWave 3.3.115, a fully featured GTK+ based wave viewer. The vulnerability pertains to a use-after-free flaw in the VCD get_vartoken realloc functionality of the software. If exploited successfully, it can lead to arbitrary code execution, potentially compromising the system and leading to data leakage. This vulnerability is especially concerning as it can be triggered simply by opening a malicious .vcd file, making it a high-risk issue for users who frequently handle .vcd files.

Vulnerability Summary

CVE ID: CVE-2023-37574
Severity: High (7.8)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise and data leakage

Affected Products

Product | Affected Versions

GTKWave | 3.3.115

How the Exploit Works

The exploit takes advantage of a use-after-free vulnerability present in the VCD get_vartoken realloc functionality of GTKWave 3.3.115. By crafting a malicious .vcd file, an attacker can trigger this vulnerability. When the file is opened, the software attempts to read the file. During the file parsing process, due to the aforementioned vulnerability, previously freed memory spaces are reaccessed, leading to a state of memory corruption. This state can then be exploited by the attacker to execute arbitrary code, compromising the system.

Conceptual Example Code

Here is a conceptual example of how a malicious .vcd file might look. This is not a real exploit, but a simplified representation to illustrate the concept.

$timescale 1 ns $end
$var wire 1 ! clk $end
$var wire 64 # data $end
$var wire 1 $ en $end
$var wire 1 % rd_wr $end
$var wire 1 & irq $end
$upscope $end
$enddefinitions $end
#0
$dumpvars
0!
bxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx #
0$
0%
0&
$end