CVE-2023-36916

What it actually does

Integer overflow during allocation of the chain_table_lengths array in fstReaderIterBlocks2 allows memory corruption that leads to arbitrary code execution when a specially crafted .fst file is processed.

Why it matters to the business

Attackers can achieve full system compromise on any host that opens malicious FST waveform files; the flaw has publicly available exploits for more than 1000 days and affects cri-o container runtime deployments across the ecosystem.

How an attack unfolds

An attacker prepares a malicious .fst file that triggers the chain_table_lengths integer overflow, then delivers the file to a victim; once the victim opens it in the vulnerable application the overflow corrupts memory and yields arbitrary code execution.

How to fix it

Upgrade cri-o to one of the fixed releases 1.29.5, 1.28.7, or 1.30.1; do not open untrusted .fst files until patched.

How to confirm the fix worked

Confirm the installed cri-o version matches a fixed release and test that known-malicious FST samples no longer trigger the overflow.

Typical attack path

1. Craft .fst file that overflows chain_table_lengths allocation
2. Deliver the file via email, download, or shared storage
3. Victim opens the file in the affected application
4. Exploit executes arbitrary code on the host

How to detect it

Review application logs and process creation events around .fst file opens for crashes, unexpected memory allocations, or child processes spawned by the waveform viewer.

What your security team should do

• Apply the cri-o patches (1.29.5 / 1.28.7 / 1.30.1) immediately
• Block or sandbox processing of .fst files from untrusted sources
• Add file-type filtering and behavioral monitoring for waveform tools