CVE-2023-39274: 
NixOS vulnerability analysis and mitigation

CVE-2023-39274 is an integer overflow vulnerability discovered in GTKWave version 3.3.115, specifically affecting the LXT2 facgeometry parsing functionality. The vulnerability was discovered by Claudio Bozzato of Cisco Talos and publicly disclosed on January 8, 2024. The issue concerns the integer overflow when allocating the len array in the software (Talos Intelligence).

The vulnerability occurs during the allocation of the len array in the LXT2 facgeometry parsing functionality. When numfacs is larger than 0x40000000, the multiplication of numfacs by 4 wraps around in 32-bit mode, resulting in a malloc call with a smaller size than intended. This is followed by a loop over numfacs that writes to the allocated buffers, leading to out-of-bounds writes on the heap. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Talos Intelligence).

The vulnerability can lead to arbitrary code execution. By carefully manipulating heap allocations, the out-of-bounds writes can be used to overwrite pointers inside the lt structure, which can then be used to write to arbitrary locations. A victim needs to open a malicious file to trigger these vulnerabilities (Talos Intelligence).

The vulnerability has been fixed in GTKWave version 3.3.118. Users are advised to upgrade to this version or later. The fix is available from the official GTKWave source (Talos Intelligence, Debian Security).