CVE-2022-23946

CVE-2022-23946 — KiCad EDA Gerber Viewer Stack-Based Buffer Overflow

Executive Summary

CVE-2022-23946 is a stack-based buffer overflow vulnerability in the Gerber Viewer component of KiCad EDA, affecting version 6.0.1 and master commit de006fc010. The vulnerability resides in the parsing of GCodeNumber data within both Gerber and Excellon file formats, and can be triggered by a specially-crafted PCB manufacturing file. Successful exploitation allows an attacker to achieve arbitrary code execution on the victim's machine when a malicious file is opened. The vulnerability carries a CVSS score of 7.8 (High) and has an EPSS score of 0.01736 (75.6th percentile), suggesting moderate exploit likelihood.

Technical Analysis

The vulnerability class is a stack-based buffer overflow, which falls under the CWE-121 category. The flaw exists in the Gerber Viewer module of KiCad EDA, specifically in the parsing logic that handles "GCodeNumber" values found in both Gerber and Excellon file formats.

Gerber files (RS-274X) are the industry standard for describing printed circuit board (PCB) copper layers, solder masks, and silkscreen. Excellon files are used to describe drill data and hole locations. Both formats are text-based and contain G-codes (e.g., G01 for linear interpolation, G02/G03 for arcs) and D-codes (aperture/drill codes). These codes are parsed by the Gerber Viewer to draw the PCB layout on screen.

The parsing of GCodeNumber values involves converting a character sequence from the file into a numeric representation. Because the code takes user-controlled numeric strings from the file and writes them into a fixed-size buffer on the stack, an overlong sequence of numeric characters (or a malformed numeric encoding that expands when converted) can overflow the stack buffer. The overflow corrupts adjacent stack memory, including saved return addresses and local variables, enabling an attacker to redirect program execution.

The attack surface is file-based: an attacker must convince the user to open a malicious Gerber or Excellon file in the KiCad Gerber Viewer (accessible via the gerbview tool or the KiCad integrated environment). This is a client-side vulnerability — the threat model is "user opens an untrusted file." No network service is exposed by the component, so no remote exploitation without user interaction is possible.

The NVD description does not specify the exact function names, buffer sizes, or the parsing routine involved. It is known that the vulnerability affects KiCad 6.0.1 and master commit de006fc010, suggesting the flaw was present in the codebase around that development period. The CNA title is empty, and no specific technical details beyond the GCodeNumber parsing location are available in the provided data. Therefore, specific function-level analysis is not possible without the patch diff.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class, as no public PoC has been identified at the time of this report. The steps below reflect the standard exploitation flow for a file-format stack buffer overflow.

Step 1 — Reconnaissance / Target Identification: The attacker identifies targets that use KiCad EDA for PCB design or review. Targets may include hardware engineers, PCB layout designers, electronics hobbyists, and organizations in the hardware/embedded systems industry. The attacker can use social engineering or supply-chain techniques to deliver the malicious file, such as embedding it in a shared project archive, posting it on a forum, or attaching it to an email disguised as a PCB manufacturing output.

Step 2 — Triggering the Flaw: The attacker crafts a malicious Gerber or Excellon file. The file contains a GCodeNumber field with an unusually long sequence of numeric characters (e.g., a G-code or D-code parameter repeated far beyond the expected buffer size). When the user opens the file in the Gerber Viewer, the parsing routine copies this string into a fixed-size stack buffer without bounds checking. The overflowing data corrupts the stack.

Step 3 — Payload / Execution Method: At the vulnerability-class level, the attacker overwrites the saved return address on the stack to redirect execution to shellcode. The shellcode itself can be embedded within the numeric overflow data — shellcode does not need to be pure ASCII, and a well-crafted payload can survive the numeric conversion (e.g., using ALPHA3-style alphanumeric shellcode for numeric-grade characters). Once control flow is hijacked, the attacker executes arbitrary code with the privileges of the user who launched the Gerber Viewer. If the user runs KiCad as an administrator, the impact escalates to full system compromise. No public PoC has been observed; the attack chain is inferred from the stack-based buffer overflow class.

Step 4 — Post-Exploitation Impact: Upon successful code execution, the attacker gains a foothold on the victim's machine. From there, the attacker can pivot to: stealing design documents (proprietary hardware IP, board layouts, FPGA bitstreams), installing persistence mechanisms, keylogging to capture credentials, exfiltrating data over the network, or using the compromised machine to attack other systems on the same network — particularly engineering workstations that may have access to sensitive industrial systems or build infrastructure.

Impact Assessment

CVSS Analysis: The vulnerability scores 7.8 High. The CVSS vector indicates: Attack Vector = Local (the attacker delivers a file), Attack Complexity = Low (no special conditions needed), Privileges Required = None (the victim opens the file), User Interaction = Required (the victim must open the malicious file), Scope = Unchanged. The primary impact is on Confidentiality, Integrity, and Availability — all High — meaning total compromise of the victim's machine.

Business Impact: For organizations in the electronics, hardware, and embedded systems sectors, the primary consequential impact is intellectual property theft. PCB designs, hardware schematics, and manufacturing files contain significant competitive value. A compromised KiCad workstation exposes these assets to theft. Additionally, the presence of a successful stack overflow implies that the attacker can tamper with the integrity of the design files, potentially injecting hardware Trojans or malicious modifications that propagate into physical products.

Blast Radius: The blast radius is limited to the individual workstation running KiCad. The vulnerability does not directly compromise networked services. However, in engineering environments where workstations have access to PLM (Product Lifecycle Management) systems, version control repositories (e.g., GitLab), or network shares containing other design files, the attacker's reach expands significantly. Lateral movement from engineering workstations is a realistic follow-on scenario.

Affected Systems:

• KiCad EDA version 6.0.1 (all platforms: Windows, Linux, macOS)
• KiCad master builds up to and including commit de006fc010
• The Gerber Viewer component (gerbview / KiCad integrated Viewer)

Detection Guidance

Sigma Rule

title: KiCad CVE-2022-23946 - Malicious Gerber/Excellon File Attempt
id: 4a3f2b9c-1d5e-4f8a-9b2d-6e7c8a1f3b2d
status: experimental
description: Detects potential exploitation attempts of KiCad Gerber Viewer stack buffer overflow via untrusted PCB files.
author: Valtersit Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\kicad-cli.exe'
            - '\gerbview.exe'
            - '\eeschema.exe'
            - '\pcbnew.exe'
            - '\kicad.exe'
        CommandLine|contains:
            - '.gbr'
            - '.excellon'
            - '.drl'
            - '.cmp'
            - '.sol'
            - '.stc'
            - '.sts'
    filter:
        CommandLine|contains:
            - '-h'
            - '--help'
    condition: selection and not filter
level: medium
falsepositives:
    - Legitimate PCB design workflow opening valid Gerber/Excellon files
tags:
    - attack.t1203
    - cve.2022-23946
    - product.kicad

YARA Rule

rule kiCad_GCodeNumber_StackOverflow_CVE_2022_23946 {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects suspicious long GCodeNumber sequences in Gerber/Excellon files indicative of CVE-2022-23946 exploitation."
        cve = "CVE-2022-23946"
        date = "2024-01-01"
        severity = "high"
    strings:
        $gcode_sequence = /[GM][0-9]{2,}[0-9]{500,}/ ascii wide  /* very long G/M code with excessive digits */
        $excellon_header = "M48" ascii wide
        $gerber_header = "G04" ascii wide
        $aperture_code = /D[0-9]{2,}[0-9]{250,}/ ascii wide      /* long D-code numeric sequence */
        $tool_string = "T[0-9]{2,}[0-9]{250,}" ascii wide         /* long Excellon tool definition */
    condition:
        (uint16(0) == 0x5A4D or $gerber_header or $excellon_header) and
        any of ($gcode_sequence, $aperture_code, $tool_string)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2022-23946 Attempted KiCad Gerber GCodeNumber Buffer Overflow"; flow:to_client; file_data; content:"M48"; within:64; content:"G90"; distance:32; within:64; content:"D10"; distance:16; within:32; pcre:"/[GM0-9]{40,}/R"; classtype:attempted-admin; sid:2022394601; rev:1; metadata:created_at 2024_01_01, updated_at 2024_01_01, cve CVE_2022_23946;)

Elastic Detection

// EQL Query: Detect KiCad process execution with suspicious file arguments
process where event.action == "start" and
  (
    process.name in ("kicad.exe", "gerbview.exe", "eeschema.exe", "pcbnew.exe", "kicad-cli.exe")
  ) and
  (
    process.args : ("*.gbr", "*.excellon", "*.drl", "*.cmp", "*.sol")
  ) and
  not process.args : ("-h", "--help", "export", "version")

Splunk SPL Query

index=endpoint sourcetype="WinEventLog:Security" OR sourcetype="XmlWinEventLog" EventID=4688
| where match(CommandLine, "(?i)(kicad|gerbview|eeschema|pcbnew).*(\\.gbr|\\.excellon|\\.drl|\\.cmp|\\.sol)")
| stats count by User, Computer, CommandLine, ParentProcessName
| where count > 1
| eval threat_name = "CVE-2022-23946_KiCad_Gerber_Exploit_Attempt"
| table _time, User, Computer, CommandLine, ParentProcessName, threat_name

Wazuh OSSEC Rule

<rule id="100239" level="12">
    <if_sid>100200</if_sid>
    <regex>(?i)(kicad|gerbview|eeschema|pcbnew).*\.(gbr|excellon|drl|cmp|sol)</regex>
    <description>Possible CVE-2022-23946 exploit attempt - KiCad Gerber Viewer opening untrusted PCB file</description>
    <group>kiCad_exploit_attempt,</group>
    <mitre>
        <id>T1203</id>
    </mitre>
    <var name="cve">CVE-2022-23946</var>
</rule>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — a single source (Debian) claims that a patch exists, but the fix has not been independently confirmed by upstream KiCad advisories, and no specific patch commit or release version has been identified. This should be treated with caution; the availability of a mitigation may not translate to a verified fix.

1) Immediate Mitigations (Valid Until Patch is Verified):

• Restrict File Opening: Implement policy controls to prevent users from opening Gerber/Excellon files from untrusted sources (email attachments, unknown downloads, external vendor files) unless files are first sanitized.
• Use a Sandbox: KiCad Gerber Viewer is a niche application. Consider running it in a dedicated virtual machine (VM) or sandboxed environment when reviewing files from untrusted sources. This contains any potential code execution to the sandbox.
• File Sanitization: If automated PCB file processing is required, the files should be passed through a text-based validation script that rejects any GCodeNumber field containing an excessively long numeric sequence (e.g., more than ~32 characters for a single code).
• User Awareness: Educate engineers to only open Gerber/Excellon files from trusted vendors and supply-chain partners.

2) Patch / Upgrade Steps:

• Monitor KiCad Release Channels: Watch for official advisory on kicad.org and the KiCad GitLab for a security advisory. The affected version is 6.0.1 (and master de006fc010).
• Upgrade: Check whether KiCad 6.0.2 or later (or the first stable release after the Debian patch claim, likely 6.0.2 or 7.0.x) includes a fix. Do NOT rely solely on the Debian claim; wait for upstream confirmation or inspect the KiCad changelog for entries mentioning "Gerber Viewer" or "GCodeNumber".
• Verify on Debian: If using Debian-based distros, check apt-cache policy kicad and review /usr/share/doc/kicad/changelog.Debian.gz for patch confirmation.
• Manual Validation: If you are building from source, review the diff between the de006fc010 commit and the de006fc011 (or any subsequent commit) to see if bounds-checking was added to the GCodeNumber parsing code. This provides concrete validation of the patch claim.

3) Long-Term Hardening:

• Default to Least Privilege: Do not run KiCad with administrator privileges. Run it as a standard user to limit the impact of a successful stack overflow.
• Application Allowlisting: Use OS-level application control (AppLocker, Windows Defender ApplicationControl, or SELinux on Linux) to restrict KiCad execution to expected users.
• Network Segmentation: Isolate engineering workstations from the rest of the corporate network to limit lateral movement in case of a compromise.
• Patch Management: Integrate KiCad into your automated patch management pipeline. Because KiCad is often installed manually (not via enterprise software center), a manual tracking mechanism must be established.
• Monitor Debian/Upstream Security Trackers: Subscribe to the [email protected] (Debian Security Announcements) and KiCad notification list to stay current on the patch confirmation.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-23946 — Official NIST NVD entry with CVSS scoring and references.
2. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2022-23946 — Debian's tracking page; primary source of the patch claim (confidence 2/4).
3. KiCad Official Website: https://www.kicad.org — For release notes and version announcements; recommended to monitor for official security advisory and patched release.
4. KiCad GitLab Repository: https://gitlab.com/kicad/code/kicad — Source repository; reference for commit history (de006fc010 affected) and future patches.
5. Exploit-DB / GitHub Search: Search for "CVE-2022-23946" on public exploit repositories — No public PoC has been identified to date. This is an active research area; the lack of a public PoC does not preclude exploit-in-the-wild trade.

Known Threat Actor Campaigns: There is no evidence of CVE-2022-23946 being exploited in the wild as of the latest threat intelligence review. The CVE does not appear on CISA's Known Exploited Vulnerabilities catalog (CISA KEV: NO). The EPSS score of 0.01736 (75.6th percentile) indicates that while exploitation is not currently widespread, the vulnerability is more likely than average to be exploited, warranting a priority patch once confirmed. The file-based delivery mechanism significantly reduces the risk compared to network-based vulnerabilities, as it requires social engineering to lure a user into opening a malicious PCB file.

Note on Patch Confidence: The patch status is CLAIMED (2/4) based solely on the Debian tracker. This is insufficient for a high-confidence remediation recommendation. The absence of an official KiCad advisory or an identifiable upstream fix commit (e.g., a patch on the KiCad GitLab) means that system administrators should verify the patch before treating the vulnerability as resolved. If the Debian claim is false, affected users remain exposed to a high-severity, high-impact client-side code execution vulnerability.