Talos Vulnerability Report

SUMMARY

An out-of-bounds write vulnerability exists in the VZT LZMA_Read dmem extraction functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability.

CONFIRMED VULNERABLE VERSIONS

The versions below were either tested or verified to be vulnerable by Talos or confirmed to be vulnerable by the vendor.

GTKWave 3.3.115

PRODUCT URLS

GTKWave - https://gtkwave.sourceforge.net

CVSSv3 SCORE

7.8 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

DETAILS

GTKWave is a wave viewer, often used to analyze FPGA simulations and logic analyzer captures. It includes a GUI to view and analyze traces, as well as convert across several file formats (.lxt, .lxt2, .vzt, .fst, .ghw, .vcd, .evcd) either by using the UI or its command line tools. GTKWave is available for Linux, Windows and MacOS. Trace files can be shared within teams or organizations, for example to compare results of simulation runs across different design implementations, to analyze protocols captured with logic analyzers or just as a reference when porting design implementations. GTKWave also sets up mime types for its supported extensions, so it’s enough for a victim to double-click on a wave file received by e-mail to cause the gtkwave program to be executed and load a potentially malicious file.

GTKWave sets up mime types for its supported extensions. So, for example, it’s enough for a victim to double-click on a wave file received by e-mail to cause the gtkwave program to be executed and load a potentially malicious file.

VZT (Verilog Zipped Trace) files are parsed by the functions found in vzt_read.c. These functions are used in the vzt2vcd file conversion utility, vztminer, and by the GUI portion of GTKwave. Thus both are affected by the issue described in this report.

To parse VZT files, the function vzt_rd_init_smp is called:

     struct vzt_rd_trace *vzt_rd_init_smp(const char *name, unsigned int num_cpus) {
[1]      struct vzt_rd_trace *lt = (struct vzt_rd_trace *)calloc(1, sizeof(struct vzt_rd_trace));
         ...

[2]      if (!(lt->handle = fopen(name, "rb"))) {
             vzt_rd_close(lt);
             lt = NULL;
         } else {
             vztint16_t id = 0, version = 0;
             ...
[3]          if (!fread(&id, 2, 1, lt->handle)) {
                 id = 0;
             }
             if (!fread(&version, 2, 1, lt->handle)) {
                 id = 0;
             }
             if (!fread(&lt->granule_size, 1, 1, lt->handle)) {
                 id = 0;
             }
         ...

At [1] the lt structure is initialized, this is the structure that will contain all the information about the input file.
The input file is opened [2] and 3 fields are read [3] to make sure the input file is a supported VZT file.

         ...
         rcf = fread(&lt->numfacs, 4, 1, lt->handle);
[4]      lt->numfacs = rcf ? vzt_rd_get_32(&lt->numfacs, 0) : 0;
         ...
         rcf = fread(&lt->numfacbytes, 4, 1, lt->handle);
         lt->numfacbytes = rcf ? vzt_rd_get_32(&lt->numfacbytes, 0) : 0;
         rcf = fread(&lt->longestname, 4, 1, lt->handle);
         lt->longestname = rcf ? vzt_rd_get_32(&lt->longestname, 0) : 0;
         rcf = fread(&lt->zfacnamesize, 4, 1, lt->handle);
         lt->zfacnamesize = rcf ? vzt_rd_get_32(&lt->zfacnamesize, 0) : 0;
         rcf = fread(&lt->zfacname_predec_size, 4, 1, lt->handle);
         lt->zfacname_predec_size = rcf ? vzt_rd_get_32(&lt->zfacname_predec_size, 0) : 0;
         rcf = fread(&lt->zfacgeometrysize, 4, 1, lt->handle);
         lt->zfacgeometrysize = rcf ? vzt_rd_get_32(&lt->zfacgeometrysize, 0) : 0;
         rcf = fread(&lt->timescale, 1, 1, lt->handle);
         ...

Several fields are then read from the file [4]:

• numfacs: the number of facilities (elements in facnames)
• numfacbytes: unused
• longestname: keeps the longest length of all defined facilities’ names
• zfacnamesize: compressed size of facnames
• zfacname_predec_size: decompressed size of facnames
• zfacgeometrysize: compressed size of facgeometry

Then, the facnames structure is extracted. This structure can be compressed with either gzip, bzip2 or lzma, depending on the first 2 bytes within this structure:

         switch (vzt_rd_det_gzip_type(lt->handle)) {
             case VZT_RD_IS_GZ:
                 lt->zhandle = gzdopen(dup(fileno(lt->handle)), "rb");
                 m = (char *)malloc(lt->zfacname_predec_size);
                 rc = gzread(lt->zhandle, m, lt->zfacname_predec_size);
                 gzclose(lt->zhandle);
                 lt->zhandle = NULL;
                 break;

             case VZT_RD_IS_BZ2:
                 lt->zhandle = BZ2_bzdopen(dup(fileno(lt->handle)), "rb");
                 m = (char *)malloc(lt->zfacname_predec_size);
                 rc = BZ2_bzread(lt->zhandle, m, lt->zfacname_predec_size);
                 BZ2_bzclose(lt->zhandle);
                 lt->zhandle = NULL;
                 break;

             case VZT_RD_IS_LZMA:
             default:
                 lt->zhandle = LZMA_fdopen(dup(fileno(lt->handle)), "rb");
                 m = (char *)malloc(lt->zfacname_predec_size);
[5]              rc = LZMA_read(lt->zhandle, m, lt->zfacname_predec_size);
                 LZMA_close(lt->zhandle);
                 lt->zhandle = NULL;
                 break;
         }

If the file type is lzma, LZMA_read [5] is called:

     size_t LZMA_read(void *handle, void *mem, size_t len) {
     #ifdef _WAVE_HAVE_XZ
         struct lzma_handle_t *h = (struct lzma_handle_t *)handle;
         size_t rc = 0;
         char hdr[2] = {0, 0};
         size_t srclen, dstlen;

         if (h) {
         top:
             switch (h->state) {
                 case LZMA_STATE_READ_INIT:
                    ...

                 case LZMA_STATE_READ_GETBLOCK:
[6]                  dstlen = LZMA_read_varint(h);
                     if (!dstlen) {
                         return (0);
                     }

                     if (dstlen > h->blksiz) /* reallocate buffers if ones in stream data are larger */
                     {
                         if (h->dmem) {
                             free(h->dmem);
                         }
                         if (h->mem) {
                             free(h->mem);
                         }
                         h->blksiz = dstlen;
[7]                      h->mem = malloc(h->blksiz);
[8]                      h->dmem = malloc(h->blksiz);
                     }

[9]                  srclen = LZMA_read_varint(h);

                     if (!srclen) {
                         h->read_cnt += (rc = read(h->fd, h->mem, dstlen));
                         h->blklen = rc;
                         h->offs = 0;
                     } else {
                         lzma_stream strm = LZMA_STREAM_INIT;
                         lzma_ret lrc;

[10]                     h->read_cnt += (rc = read(h->fd, h->dmem, srclen));

                         ...

                 case LZMA_STATE_READ_ERROR:
                 default:
                     break;
             }
         }

         return (rc);

The lzma-compressed data is parsed using states. When reading a block, the state is LZMA_STATE_READ_GETBLOCK. In this state, blocks are decompressed as follows:

• dstlen is extracted from file as a varint [6]. The encoding for varints in VZT are similar to LEB128, except the termination bit is 1 and not 0.
• dstlen is used to allocate the mem [7] and dmem [8] buffers.
• srclen is read as a varint.
• dmem is filled from file, with a size given by srclen [10].

dmem’s size depends on dstlen. However, the read at [10] depends on srclen. If srclen is bigger than dstlen, this leads to writing out-of-bounds of dmem (which is allocated in heap), which in turns leads to arbitrary code execution.

Note that lzma-compressed structures can be found in facnames, facgeometry and any other block later defined with the VZT file, which can all be used to trigger this issue.

Crash Information

==401082==ERROR: AddressSanitizer: heap-buffer-overflow on address 0xf5e00651 at pc 0xf79df56f bp 0xffffd508 sp 0xffffd0e0
WRITE of size 62 at 0xf5e00651 thread T0
    #0 0xf79df56e in __interceptor_read ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1025
    #1 0x5656fe22 in LZMA_read ../liblzma/LzmaLib.c:338
    #2 0x56563fdf in vzt_rd_init_smp src/helpers/vzt_read.c:1791
    #3 0x565697f3 in vzt_rd_init src/helpers/vzt_read.c:2194
    #4 0x5656be5b in process_vzt src/helpers/vzt2vcd.c:176
    #5 0x5656cf15 in main src/helpers/vzt2vcd.c:464
    #6 0xf7611294 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    #7 0xf7611357 in __libc_start_main_impl ../csu/libc-start.c:381
    #8 0x565574f6 in _start (vzt2vcd+0x24f6)

0xf5e00651 is located 0 bytes to the right of 1-byte region [0xf5e00650,0xf5e00651)
allocated by thread T0 here:
    #0 0xf7a55ffb in __interceptor_malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
    #1 0x5656fad1 in LZMA_read ../liblzma/LzmaLib.c:322
    #2 0x56563fdf in vzt_rd_init_smp src/helpers/vzt_read.c:1791
    #3 0x565697f3 in vzt_rd_init src/helpers/vzt_read.c:2194
    #4 0x5656be5b in process_vzt src/helpers/vzt2vcd.c:176
    #5 0x5656cf15 in main src/helpers/vzt2vcd.c:464
    #6 0xf7611294 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:1025 in __interceptor_read
Shadow bytes around the buggy address:
  0x3ebc0070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3ebc0080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3ebc0090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3ebc00a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3ebc00b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x3ebc00c0: fa fa fa fa fa fa fa fa fa fa[01]fa fa fa 01 fa
  0x3ebc00d0: fa fa 01 fa fa fa 01 fa fa fa 04 fa fa fa 00 04
  0x3ebc00e0: fa fa 00 03 fa fa 00 04 fa fa 00 05 fa fa 00 04
  0x3ebc00f0: fa fa 00 05 fa fa 00 00 fa fa fa fa fa fa fa fa
  0x3ebc0100: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x3ebc0110: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb

VENDOR RESPONSE

Fixed in version 3.3.118, available from https://sourceforge.net/projects/gtkwave/files/gtkwave-3.3.118/

TIMELINE

2023-08-02 - Vendor Disclosure
2023-12-31 - Vendor Patch Release
2024-01-08 - Public Release