CVE-2023-38652

What it actually does

Integer overflow in VZT vzt_rd_block_vch_decode dict parsing allows memory corruption when num_time_ticks is nonzero in a crafted file.

Why it matters to the business

Users opening untrusted waveform files risk crashes or code execution that could disrupt hardware verification and design workflows.

How an attack unfolds

An attacker creates a malicious .vzt file containing an oversized num_time_ticks value, then delivers it to a victim who opens it in GTKWave, triggering the overflow and memory corruption.

How to fix it

Upgrade GTKWave to the latest available version that resolves VZT parsing issues; if no fixed release exists, avoid opening untrusted .vzt files and consider alternative waveform viewers.

How to confirm the fix worked

Confirm GTKWave version is newer than 3.3.115 and test parsing of sample files containing large num_time_ticks values for absence of crashes or corruption.

Typical attack path

1. Craft .vzt file with manipulated num_time_ticks in dict block
2. Deliver file via email, download, or shared storage
3. Victim opens file in vulnerable GTKWave instance
4. Integer overflow occurs during vzt_rd_block_vch_decode parsing
5. Memory corruption leads to crash or potential code execution

How to detect it

Review file-open logs and process execution history for GTKWave instances loading .vzt files from external or unexpected locations; look for sudden crashes or memory-related error reports during VZT parsing.

What your security team should do

• Block opening of .vzt files from untrusted sources until patched
• Monitor for new GTKWave releases addressing VZT integer overflows
• Educate hardware teams on risks of opening external waveform files