CVE-2023-35970

What it actually does

Heap-based buffer overflow in fstReaderIterBlocks2 during chain_table parsing of FST_BL_VCDATA_DYN_ALIAS2 sections in .fst files, enabling arbitrary code execution.

Why it matters to the business

Attackers can achieve full control over engineering workstations that process waveform files, risking theft of proprietary designs and disruption of hardware verification workflows; the issue remains unpatched in listed versions with public exploits available.

How an attack unfolds

An attacker crafts a malicious .fst file containing oversized or malformed chain_table data in the FST_BL_VCDATA_DYN_ALIAS2 section. When a victim opens the file in the vulnerable application, the parser overflows a heap buffer, allowing the attacker to overwrite memory and execute arbitrary code.

How to fix it

Avoid opening untrusted .fst files. Monitor vendor releases for versions beyond 3.3.115 and apply updates immediately when available. Consider sandboxing or alternative viewers for external waveform files.

How to confirm the fix worked

Confirm the application version is newer than 3.3.115 and test with known-good and malformed .fst samples in an isolated environment to verify absence of crashes or code execution.

Typical attack path

1. Attacker generates malicious .fst file exploiting chain_table parsing
2. Attacker delivers file via email, download, or shared storage
3. Victim opens file in affected GTKWave version
4. Parser processes FST_BL_VCDATA_DYN_ALIAS2 section and overflows heap buffer
5. Attacker gains arbitrary code execution on the system

How to detect it

Inspect system and application logs for crashes or abnormal memory usage when processing .fst files. Look for execution of unexpected processes or scripts immediately after opening waveform files from external sources.

What your security team should do

• Block opening of .fst files from untrusted sources via email and web filters
• Update GTKWave to the latest available version as soon as released
• Educate users on risks of opening waveform files from unknown origins
• Monitor for public exploit code and increase scrutiny on engineering endpoints