CVE-2023-37578: Use-After-Free Vulnerabilities in GTKWave 3.3.115 Leading to Arbitrary Code Execution

Overview

We are delving into the details of a serious vulnerability identified as CVE-2023-37578. This vulnerability is present in the popular waveform viewer and simulator, GTKWave, specifically version 3.3.115. This vulnerability arises from multiple use-after-free conditions within the VCD get_vartoken realloc functionality. Its severity is underscored by the potential for arbitrary code execution, which could lead to system compromise and data leakage. Victims are at risk if they open a specially crafted, malicious .vcd file. As such, users of GTKWave, especially those dealing with untrusted .vcd files, should be aware of and take immediate steps to mitigate this risk.

Vulnerability Summary

CVE ID: CVE-2023-37578
Severity: High (CVSS: 7.8)
Attack Vector: Local
Privileges Required: User
User Interaction: Required
Impact: Arbitrary code execution, potential system compromise, and data leakage.

Affected Products

Product | Affected Versions

GTKWave | 3.3.115

How the Exploit Works

The vulnerability lies in the VCD get_vartoken realloc functionality of GTKWave. In this context, realloc is used to adjust the size of a block of memory that was previously allocated. The issue stems from a use-after-free condition, which occurs when a program continues to use a pointer after it has been freed.
A malicious actor can exploit this vulnerability by creating a specially crafted .vcd file. When this file is opened in GTKWave, specifically during the vcd2lxt conversion process, the use-after-free condition can be triggered, allowing for arbitrary code execution. This can potentially compromise the system and result in data leakage.

Conceptual Example Code

While the exact exploit code is not provided for ethical and security reasons, the conceptual example below illustrates the process an attacker may follow:

#1. Craft a malicious .vcd file
echo "malicious_code" > malicious.vcd
#2. Send or make the malicious .vcd file available to the victim
#3. The victim opens the malicious .vcd file with GTKWave 3.3.115
GTKWave -vcd malicious.vcd
#4. The use-after-free vulnerability is triggered, executing the malicious code

It’s important to note that this is a simplified example and actual exploitation would involve a more complex and specifically crafted malicious .vcd file.