CVE-2023-37282: 
NixOS vulnerability analysis and mitigation

An out-of-bounds write vulnerability (CVE-2023-37282) was discovered in GTKWave version 3.3.115, specifically affecting the VZT LZMA_Read dmem extraction functionality. The vulnerability was discovered by Claudio Bozzato of Cisco Talos and was publicly disclosed on January 8, 2024. GTKWave, a wave viewer commonly used for analyzing FPGA simulations and logic analyzer captures, is affected across its Linux, Windows, and MacOS distributions (Talos Intelligence).

The vulnerability is classified as an out-of-bounds write (CWE-787) with a CVSS v3.1 base score of 7.8 (HIGH). The issue occurs in the LZMA decompression of VZT files where the size of the destination buffer (dstlen) is used to allocate memory, but the source length (srclen) is used for reading data. If srclen is larger than dstlen, it leads to a heap buffer overflow, potentially enabling arbitrary code execution (Talos Intelligence).

The vulnerability can lead to arbitrary code execution when a specially crafted .vzt file is processed. Since GTKWave sets up mime types for its supported extensions, simply double-clicking on a malicious wave file received via email can trigger the vulnerability. This affects both the GUI portion of GTKWave and the vzt2vcd file conversion utility (Talos Intelligence).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are advised to upgrade to this or later versions. The fix was released on December 31, 2023, and is available from the official GTKWave distribution site (Talos Intelligence).