CVE-2025-23016

What it actually does

Integer overflow in ReadParams within fcgiapp.c allows crafted nameLen or valueLen values sent over the IPC socket to trigger a heap-based buffer overflow in fcgi2 2.x through 2.4.4.

Why it matters to the business

Systems relying on the affected FastCGI library or dependent packages such as older tcpdump releases on Ubuntu 14.04 and 16.04 face elevated risk of service disruption or unauthorized code execution, requiring prioritized patching of long-supported distributions and library dependencies.

How an attack unfolds

An attacker supplies specially crafted parameter length fields over the IPC socket to the ReadParams function, causing an integer overflow that leads to an undersized allocation followed by a heap buffer overflow that can be leveraged for memory corruption.

How to fix it

Upgrade fcgi2 to commit 12ae40e58f6b1d8325408ff6765894f09994f5a9 or later; apply the Ubuntu 14.04 and 16.04 patches that update tcpdump to 4.9.2-0ubuntu0.14.04.1 and 4.9.2-0ubuntu0.16.04.1 respectively; rebuild and redeploy any packages that statically link the vulnerable library.

How to confirm the fix worked

Verify the installed fcgi2 version or commit hash against the fixed commit; confirm tcpdump package versions on Ubuntu systems match the listed fixed releases; recompile test binaries against the updated library and exercise parameter parsing paths.

Typical attack path

1. Identify a process or service using the vulnerable fcgi2 library that listens on an IPC socket
2. Craft a FastCGI parameter record containing oversized or malicious nameLen/valueLen values
3. Transmit the record to the IPC socket
4. Trigger the integer overflow and subsequent heap write in ReadParams
5. Achieve memory corruption suitable for code execution or denial of service

How to detect it

Review application and system logs for unusual parameter lengths or crashes in processes linked to fcgi2; monitor IPC socket traffic for malformed FastCGI records; inspect core dumps or heap corruption indicators in affected services.

What your security team should do

• Immediately inventory all deployments that link against fcgi2 or ship the listed tcpdump versions
• Schedule upgrades to the fixed library commit and Ubuntu package revisions within the next maintenance window
• Add fcgi2 and tcpdump to the vulnerability scanning policy with version pinning
• Review any custom FastCGI IPC handling code for similar length validation issues