CVE-2025-2723

What it actually does

Heap-based buffer overflow in the gsf_property_settings_collec function triggered by manipulation of the n_alloced_params argument, enabling memory corruption.

Why it matters to the business

Local compromise of affected Red Hat virtualization host systems can lead to application crashes, unauthorized code execution, and potential full system takeover, increasing operational risk on enterprise Linux 7 hypervisor deployments.

How an attack unfolds

An attacker with local access crafts input that manipulates n_alloced_params in the vulnerable collection function, overflowing the heap buffer to corrupt memory and potentially achieve arbitrary code execution within the process context.

How to fix it

Update affected Red Hat packages to the fixed versions: redhat-virtualization-host to 0:4.2-20190129.0.el7_6, redhat-virtualization-host-image-update to 0:4.2-20190129.0.el7_6, redhat-release-virtualization-host to 0:4.2-8.1.el7, and redhat-virtualization-host-image-update-placeholder to 0:4.2-8.1.el7. Reboot hypervisor hosts after patching.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed releases using package managers, and confirm libgsf is updated beyond 1.14.53 in the environment.

Typical attack path

1. Gain local shell or process execution on the target system
2. Identify or trigger usage of the gsf_property_settings_collec function with attacker-controlled parameters
3. Supply a malicious n_alloced_params value to induce heap overflow
4. Leverage memory corruption for code execution or denial of service

How to detect it

Review system logs for segmentation faults or crashes involving libgsf or gsf_property_settings_collec, and inspect process memory dumps or audit trails for unexpected local invocations of the library.

What your security team should do

• Apply the specified package updates immediately on all Red Hat Enterprise Linux 7 hypervisor systems
• Restrict local access and review processes that invoke libgsf functions
• Monitor for post-patch stability and scan for any remaining vulnerable instances