CVE-2023-37420

What it actually does

Out-of-bounds write in VCD parse_valuechange portdump handling within the vcd2lxt utility allows arbitrary code execution when processing a malicious .vcd file.

Why it matters to the business

Attackers can achieve code execution on systems where users open untrusted waveform files with the conversion utility, potentially leading to compromise of engineering workstations and intellectual property exposure in hardware design environments.

How an attack unfolds

An attacker crafts a malicious .vcd file that triggers an out-of-bounds write during value-change parsing in vcd2lxt; the victim opens the file with the conversion utility, causing memory corruption that results in arbitrary code execution on the local system.

How to fix it

Avoid processing untrusted .vcd files with vcd2lxt until a patched version of GTKWave is available; consider disabling or removing the conversion utility from environments that handle external waveform data.

How to confirm the fix worked

Confirm GTKWave is updated past the vulnerable 3.3.115 release and test that vcd2lxt no longer crashes or executes code on known-malicious test files.

Typical attack path

1. Attacker creates a specially crafted .vcd file exploiting the portdump parsing flaw
2. Attacker delivers the file to the victim via email, download, or shared storage
3. Victim invokes vcd2lxt on the malicious file
4. Out-of-bounds write occurs leading to arbitrary code execution

How to detect it

Review process execution logs and file-access records for invocations of vcd2lxt against externally sourced .vcd files; look for unexpected crashes or child processes spawned from the utility.

What your security team should do

• Block or sandbox use of vcd2lxt on untrusted inputs until a fix is released
• Monitor for new GTKWave releases addressing the memory corruption
• Educate hardware and verification teams on risks of opening external waveform files