CVE-2022-23804

Executive Summary

CVE-2022-23804 is a stack-based buffer overflow vulnerability in the Gerber Viewer component of KiCad EDA, specifically within the ReadIJCoord coordinate parsing functionality of gerber and excellon file formats. KiCad EDA 6.0.1 and master commit de006fc010 are affected. Exploitation occurs when a user opens a specially-crafted Gerber or Excellon file, which can result in arbitrary code execution on the victim's machine. The vulnerability carries a CVSS score of 7.8 (High), reflecting local attack vector with high impact to confidentiality, integrity, and availability. Risk is elevated because Gerber/Excellon files are commonly exchanged between PCB designers, manufacturers, and fabrication houses, making targeted malicious file delivery a plausible attack vector. No evidence of in-the-wild exploitation or public PoC is currently available.

Technical Analysis

The vulnerability exists in the Gerber Viewer's coordinate parsing routine, specifically in the ReadIJCoord function (named verbatim in the NVD description) which handles I/J coordinate data from both Gerber and Excellon file formats. Gerber files (RS-274X) are the de facto industry standard for PCB fabrication data, while Excellon files define drill hole locations. Both formats contain coordinate data that must be parsed from ASCII text into numeric representations. The ReadIJCoord function processes these coordinates and is vulnerable to a stack-based buffer overflow.

Vulnerability Mechanism: Stack-based buffer overflow flaws occur when a program writes more data to a stack-allocated buffer than the buffer can hold. In this case, a specially-crafted file containing overly long or malformed coordinate data can cause the ReadIJCoord parsing routine to write beyond the bounds of a stack-allocated buffer, corrupting adjacent stack memory. On modern systems, stack corruption can overwrite the saved return address, stack canary values (if present), or other critical control-flow data.

Attack Surface: The attack surface is the Gerber Viewer application itself. KiCad EDA is an open-source electronics design automation suite used primarily by hardware engineers, PCB designers, and electronics manufacturing professionals. The Gerber Viewer (gerbv-like functionality) is a standalone component used to preview fabrication files. When a user opens a malicious file — either directly or via drag-and-drop — the parsing engine processes the untrusted file contents.

Code-Level Context: While direct source code analysis is not available from the NVD description, the class of vulnerability is well understood. The ReadIJCoord function name indicates it parses I and J offset coordinates, which in Gerber format define arc centers relative to the current point. These coordinates are specified as numeric values that must be tokenized from the input stream. A malformed value — either excessively long before a terminator character, or containing unexpected characters that cause incorrect length calculations — can trigger the overflow condition.

Affected Version Specificity: The NVD description specifically names KiCad EDA 6.0.1 and master commit de006fc010. The master commit reference suggests the vulnerability was present until a specific fix was merged. KiCad 6.0.1 was a point release in the 6.0 stable series, indicating the flaw was introduced during the 6.0 development cycle and remained present in at least the first point release.

Exploitation Scenarios

Step 1 — Reconnaissance/Target Identification: An attacker targeting a specific organization would identify employees who work with PCB design and manufacturing files. This includes hardware engineers, PCB layout designers, and procurement or quality control staff who receive Gerber files from fabrication vendors. Alternatively, a broad attack could involve poisoning file-sharing repositories, PCB design forums, or "free library" download sites with malicious Gerber/Excellon files. Spear-phishing with attachments named according to PCB design conventions (e.g., board_v2_final.gbr, drill.xln) would be a plausible delivery mechanism.

Step 2 — Triggering the Vulnerability: The attacker crafts a malicious Gerber or Excellon file that contains malformed I/J coordinate data within an arc definition. In Gerber format, an arc is defined similarly to G03X....Y....I....J....D01* where I and J values represent offsets from the start point to the arc center. In Excellon files, similar coordinate parsing occurs for drill positions. The malicious file is delivered as an email attachment, downloaded from a compromised site, or transferred via collaboration tools. When the victim opens the file in KiCad's Gerber Viewer, the parsing engine invokes the vulnerable ReadIJCoord function, which processes the oversized coordinate data and overflows the stack.

Step 3 — Payload/Execution Method: At the vulnerability-class level, the attack aims to overwrite the saved instruction pointer (return address) on the stack with an address pointing to attacker-controlled code. Since the overflow is in a file-parsing context, exploitation typically involves either: (a) return-oriented programming (ROP) with gadgets available in the KiCad binary or its linked libraries to perform arbitrary operations, or (b) stack execution if DEP (Data Execution Prevention) is disabled — a rarity on modern systems. The payload would ultimately execute shellcode that, for example, spawns a reverse shell, downloads additional malware, or drops a backdoor. No public PoC exists, so exact exploitation primitives are unconfirmed; however, stack overflow exploitation is a well-documented class with mature techniques.

Step 4 — Post-Exploitation Impact: Successful exploitation achieves code execution in the context of the user running the Gerber Viewer. Given typical desktop user privileges, the attacker gains access to the victim's user account, including access to files the user can read/write, keystrokes, browser history, saved credentials, and network-accessible resources. In enterprise environments, this foothold could be leveraged for lateral movement — for example, stealing design data (intellectual property in the form of PCB layouts), obtaining VPN credentials, or escalating privileges if the host has misconfigurations.

Note on Availability: No public PoC or exploit code is available for this CVE. The attack chain above is inferred from the vulnerability class (stack buffer overflow in file parsing) and the NVD description. Specific exploit primitives, exact payload structures, or observed campaigns do not exist in the provided intelligence data.

Impact Assessment

CVSS Analysis (7.8 High): Using the base vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H:

• Attack Vector (L): Local — the attacker must deliver a file for the victim to open locally; there is no network-exposed service.
• Attack Complexity (L): Low — no special conditions beyond user opening the file; the malformed file structure is deterministic.
• Privileges Required (N): None — the attacker does not need any pre-existing access.
• User Interaction (R): Required — the victim must open the malicious file.
• Impact (C:H/I:H/A:H): High on all three pillars — full file read/write, code execution, and potential denial of service/crash.

Business Impact: For organizations in hardware design, the primary business impact is intellectual property theft. PCB designs represent significant R&D investment, and a compromised workstation could exfiltrate design files, BOM (Bill of Materials) data, and manufacturing specifications. For generic enterprises, the impact is the standard RCE foothold: full user compromise enabling data theft, credential harvesting, and lateral movement.

Blast Radius: The immediate blast radius is the victim's host. However, hardware design environments often share network drives with Gerber library files, and compromised CAD tools can be leveraged to exfiltrate large batches of design data silently. The lack of network exposure (local attack vector) limits remote exploitation without user interaction, but phishing remains a highly effective delivery method. EPSS score of 0.01643 (74.2% percentile) indicates moderate exploitation likelihood in the broader vulnerability ecosystem, though no active exploitation has been observed.

Affected Systems: KiCad EDA 6.0.1 and the specific master commit de006fc010. KiCad runs on Windows, Linux, and macOS. All platforms loading Gerber/Excellon files through the Gerber Viewer are potentially affected, though code-level differences per platform may affect exploitability.

Detection Guidance

Sigma Rule

title: KiCad Gerber Viewer Malicious File - CVE-2022-23804
id: 4c8f2f1a-9c6e-4b3a-9c77-df4d6b4d8a2e
status: experimental
description: Detects process behavior consistent with KiCad Gerber Viewer crashing or exhibiting anomalous stack behavior when parsing suspicious Gerber/Excellon files
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-23804
author: Valtersit Threat Intel
date: 2024/06/01
tags:
    - attack.t1203
    - cve.2022-23804
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\kicad-cli.exe'
            - '\pcbnew.exe'
            - '\gerbview.exe'
        CommandLine|contains:
            - '.gbr'
            - '.ger'
            - '.xln'
            - '.drl'
    filter:
        CommandLine|contains:
            - '\temp\'
            - '\downloads\'
    condition: selection and not filter
    timeframe: 5s
level: high
falsepositives:
    - Legitimate workflow when users open Gerber files from their Downloads or Temp folder
    - OAuth prompt flow on frequent file reviews

YARA Rule

rule CVE_2022_23804_KiCad_Gerber_Overflow_Indicators {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects strings/patterns potentially triggering CVE-2022-23804 stack buffer overflow in KiCad ReadIJCoord parsing"
        date = "2024-06-01"
        cve = "CVE-2022-23804"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-23804"
    strings:
        $gerber_ext = ".gbr" ascii wide nocase
        $excellon_ext = ".xln" ascii wide nocase
        $gerber_ext_alt = ".ger" ascii wide nocase
        $arc_cmd_g03 = "G03" ascii wide
        $arc_cmd_g02 = "G02" ascii wide
        $coord_i = "I" ascii wide
        $coord_j = "J" ascii wide
        $long_numeric = 40..250 ascii
        $overflow_pattern = { 49 4A 2E 31 2E 32 2E 33 } /* IJ.1.2.3 potentially oversized */
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and (1 of ($gerber_ext*))
        and ($arc_cmd_g0*) and ($coord_i or $coord_j)
        and #long_numeric >= 5
        and filesize > 1KB
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2022-23804 KiCad Gerber Viewer Potential Malicious File Transfer"; flow:established,to_server; content:"G0"; content:"I"; content:"J"; pcre:"/G0[23][^D]*I[^\*]{50,}/"; pcre:"/G0[23][^D]*J[^\*]{50,}/"; sid:202423804; rev:1; reference:cve,2022-23804; classtype:attempted-user; metadata:created_at 2024_06_01, updated_at 2024_06_01;)

Elastic Detection

sequence by process.pid with maxspan=5s
  [process where event.type == "start" and
   process.name in ("gerbview.exe", "pcbnew.exe", "kicad-cli.exe") and
   process.args in ("*.gbr", "*.ger", "*.xln", "*.drl")]
  [process where event.type == "end" and
   process.exit_code != 0 and
   process.name in ("gerbview.exe", "pcbnew.exe", "kicad-cli.exe")]

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security OR sourcetype=ProcessCreation
| table _time, User, Image, CommandLine, ExitCode
| where match(CommandLine, "(?i)\.(gbr|ger|xln|drl)")
| stats count by Image, CommandLine
| where count > 0
| eval suspicious = if(match(CommandLine, "(?i)(temp|downloads|attachment)"), "high_risk", "medium_risk")
| search suspicious="high_risk"
| stats values(suspicious) as risk_flag, count as process_count by Image, CommandLine

Wazuh OSSEC Rule

<rule id="100238" level="12">
    <if_sid>550</if_sid>
    <match>kicad|gerbview|pcbnew</match>
    <description>CVE-2022-23804: KiCad Gerber Viewer process detected with potentially malicious file argument</description>
    <group>cve_2022_23804,process_termination,</group>
    <options>no_full_log</options>
</rule>

<rule id="100239" level="12">
    <if_sid>100238</if_sid>
    <regex>kicad.*\.(gbr|ger|xln|drl).*</regex>
    <description>CVE-2022-23804: KiCad opening Gerber/Excellon file - potential exploitation vector</description>
    <group>cve_2022_23804,</group>
</rule>

<rule id="100240" level="15">
    <if_sid>100239</if_sid>
    <regex>Segmentation|fault|crash|buffer</regex>
    <description>CVE-2022-23804: KiCad Gerber Viewer crash - possible stack overflow exploitation</description>
    <group>cve_2022_23804,exploit_attempt,</group>
</rule>

Mitigation & Patch Guidance

Patch Confidence Assessment: Patch confidence is rated 2/4 (CLAIMED) — a single source (Debian) claims the issue is patched, but this has not been independently confirmed. Security teams should validate the presence of a fix in their specific KiCad distribution before assuming remediation.

1) Immediate Mitigations (apply now):

• User awareness & policy: Instruct all users who handle Gerber/Excellon files to treat them like executable attachments. Do not open files from untrusted sources, unexpected senders, or unverified fabrication vendors.
• Restrict file delivery channels: Disable auto-open behavior for .gbr, .ger, .xln, .drl file extensions in email clients and web browsers. Configure these to be saved to disk and scanned before opening.
• Sandboxing: Use application sandboxing (Windows Sandbox, Firejail on Linux, or macOS sandboxed execution) to run KiCad Gerber Viewer in an isolated environment with minimal privileges and no network egress.
• EDR visibility: Ensure any EDR solution monitors process creation for gerbview.exe, pcbnew.exe, or kicad-cli.exe with Gerber/Excellon file arguments, and alerts on abnormal crashes or child process spawns from these binaries.

2) Patch/Upgrade Steps:

• Verify whether your Linux distribution (e.g., Debian) has a patched KiCad package beyond 6.0.1. Check with apt-cache policy kicad or equivalent.
• For non-Debian systems, check for a KiCad release newer than 6.0.1 that addresses this CVE. The NVD reference to master commit de006fc010 suggests the fix was applied in subsequent commits; upgrading to the latest stable release (or at minimum a version above 6.0.1) is advisable.
• Independently confirm the claimed fix by reviewing KiCad's public Git repository commit history for changes to the Gerber/Excellon coordinate parsing code.
• If a patched version cannot be confirmed, consider disabling the Gerber Viewer entirely or using an alternative Gerber preview tool (e.g., online viewers with no local parsing) until a confirmed patch is available.

3) Long-Term Hardening:

• Standardize file ingestion: Establish a policy requiring all incoming Gerber/Excellon files to be opened ONLY in a dedicated, low-privilege VM or containerized environment.
• Harden the application: Omit the Gerber Viewer component from KiCad installations for users who do not strictly require it. Enable all available memory-protection features on the host OS (ASLR, DEP, stack canaries at the compiler level on source builds).
• Security controls: Deploy file-reputation scanning that flags Gerber/Excellon files from new/untrusted senders. Use email gateway filtering to block these attachment types unless specifically allow-listed.
• Monitor for exploitation: Add the Sigma/YARA/Elastic/Splunk/Wazuh detections provided above to your monitoring and alerting stack. Pay attention to abnormal KiCad process crashes or unusual file-open patterns.
• Incident response readiness: Include this CVE in tabletop exercises. If exploitation is suspected, treat it as a potential full-user compromise — rotate credentials, inspect for persistence mechanisms, and review network egress for data exfiltration.

References

1. NVD Entry — CVE-2022-23804: https://nvd.nist.gov/vuln/detail/CVE-2022-23804 Official NIST National Vulnerability Database record containing the description, CVSS score, and references.

2. Mitre CVE Record: https://www.cve.org/CVERecord?id=CVE-2022-23804 Mitre's CVE record, cross-referencing the NVD data and any additional vendor statements.

3. Debian Security Tracker (patch claim): https://security-tracker.debian.org/tracker/CVE-2022-23804 Source of the single-source patch claim (2/4 confidence). Security teams should monitor this page for confirmation of the fix.

4. KiCad Official Website: https://www.kicad.org/ Official KiCad project page — monitor for security advisories and release notes of patched versions.

5. KiCad Git Repository (fix identification): https://gitlab.com/kicad/code/kicad The KiCad source repository; advisories may reference the specific commit de006fc010 and the subsequent fix. This is the authoritative source for confirming the patch status independently.

Known Threat Actor Campaigns / Exploitation Evidence: As of the date of this report, there is no evidence of in-the-wild exploitation, no public PoC, no exploit code availability, and no inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.01643 (74.2% percentile) suggests that while exploitation is possible, no active campaigns have been observed. Threat actors targeting hardware/manufacturing sectors may develop exploits for this in the future, making proactive patching and detection a priority.