Several GTKWave Vulnerabilities Fixed in Debian

Rohan Timalsina

April 16, 2024 - TuxCare expert team

Recently, the Debian security team fixed several issues in GTKWave, an open-source waveform viewer for VCD (Value Change Dump) files. These vulnerabilities, if exploited, could result in the execution of arbitrary code, posing a significant risk to users. The security updates address a total of 82 identified vulnerabilities. This article details some of the patched GTKWave vulnerabilities in Debian and offers guidance to mitigate the risks.

Vulnerabilities Discovered in GTKWave

CVE-2023-32650

An integer overflow vulnerability was found in the FST_BL_GEOM parsing maxhandle functionality of GTKWave 3.3.115 when compiled as a 32-bit binary. When a malicious .fst file is opened, it could lead to memory corruption.

CVE-2023-39273

This vulnerability stems from multiple integer overflow issues within the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. When a malicious .lxt2 file is opened, attackers can trigger arbitrary code execution. In this vulnerability, an integer overflow occurs when allocating the flags array.

CVE-2023-39274

This issue also arises from integer overflow within the LXT2 facgeometry parsing functionality. When a malicious .lxt2 file is opened, attackers can exploit this vulnerability, resulting in arbitrary code execution. Here, an integer overflow occurs when allocating the len array.

CVE-2023-39275

Another integer overflow vulnerability occurs within the LXT2 facgeometry parsing functionality when allocating the `value` array. A malicious .lxt2 file could lead to arbitrary code execution.

CVE-2023-39316

This vulnerability involves integer overflow in the LXT2 num_dict_entries functionality. Attackers can exploit this issue through a specially crafted .lxt2 file, leading to arbitrary code execution. The integer overflow occurs during the allocation of the string_pointers array.

CVE-2023-39317

Similar to the previous vulnerability, this issue also involves integer overflow within the LXT2 num_dict_entries functionality. Attackers can exploit this vulnerability through a specially crafted .lxt2 file, resulting in arbitrary code execution. Here, the overflow occurs when allocating the string_lens array.

It is important to note that these vulnerabilities require a user to open a malicious file. However, attackers can trick users into opening such files through social engineering techniques. To view all the fixed gtkwave vulnerabilities, please visit the official security advisory.

Mitigation Measures

The most effective way to mitigate these vulnerabilities is to upgrade your gtkwave package to a fixed version. For users of the oldstable distribution (bullseye), these vulnerabilities have been addressed in version 3.3.104+really3.3.118-0+deb11u1. For those on the stable distribution (bookworm), version 3.3.118-0.1~deb12u1 contains the necessary fixes.

Additionally, by avoiding downloading files from untrusted sources and practicing safe browser habits, you can significantly reduce your risk of being exploited by these vulnerabilities.

Conclusion

While GTKWave is a valuable tool for waveform viewing, these vulnerabilities highlight the importance of promptly addressing security issues to safeguard users’ systems from potential exploitation. It is strongly advised to upgrade your gtkwave packages to ensure your system’s security.

Source: Debian Security Advisory

Summary