An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest. (CVE-2015-3456)

After installing this update, shut down all running virtual machines.
Once all virtual machines have shut down, start them again for this update to take effect.

Jason Geffner, CrowdStrike Senior Security Researcher reports :

VENOM, CVE-2015-3456, is a security vulnerability in the virtual floppy drive code used by many computer virtualization platforms. This vulnerability may allow an attacker to escape from the confines of an affected virtual machine (VM) guest and potentially obtain code-execution access to the host. Absent mitigation, this VM escape could open access to the host system and all other VMs running on that host, potentially giving adversaries significant elevated access to the host's local network and adjacent systems.

KVM was updated to fix a buffer overflow in the floppy drive emulation, which could be used to carry out denial of service attacks or potential code execution against the host. This vulnerability is also known as VENOM. (CVE-2015-3456)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1003 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for     Linux on AMD64 and Intel 64 systems.

    An out-of-bounds memory access flaw was found in the way QEMU's virtual     Floppy Disk Controller (FDC) handled FIFO buffer access while processing     certain FDC commands. A privileged guest user could use this flaw to crash     the guest or, potentially, execute arbitrary code on the host with the     privileges of the host's QEMU process corresponding to the guest.
    (CVE-2015-3456)

    Red Hat would like to thank Jason Geffner of CrowdStrike for reporting     this issue.

    All kvm users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. Note: The procedure in     the Solution section must be performed before this update will take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2608-1 advisory.

    Jason Geffner discovered that QEMU incorrectly handled the virtual floppy driver. This issue is known as     VENOM. A malicious guest could use this issue to cause a denial of service, or possibly execute arbitrary     code on the host as the user running the QEMU process. In the default installation, when QEMU is used with     libvirt, attackers would be isolated by the libvirt AppArmor profile. (CVE-2015-3456)

    Daniel P. Berrange discovered that QEMU incorrectly handled VNC websockets. A remote attacker could use     this issue to cause QEMU to consume memory, resulting in a denial of service. This issue only affected     Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-1779)

    Jan Beulich discovered that QEMU, when used with Xen, didn't properly restrict access to PCI command     registers. A malicious guest could use this issue to cause a denial of service. This issue only affected     Ubuntu 14.04 LTS and Ubuntu 14.10. (CVE-2015-2756)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1011 advisory.

    The rhev-hypervisor packages provide a Red Hat Enterprise Virtualization     Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor     is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes     everything necessary to run and manage virtual machines: a subset of the     Red Hat Enterprise Linux operating environment and the Red Hat Enterprise     Virtualization Agent.

    Note: Red Hat Enterprise Virtualization Hypervisor is only available for     the Intel 64 and AMD64 architectures with virtualization extensions.

    An out-of-bounds memory access flaw was found in the way QEMU's virtual     Floppy Disk Controller (FDC) handled FIFO buffer access while processing     certain FDC commands. A privileged guest user could use this flaw to crash     the guest or, potentially, execute arbitrary code on the host with the     privileges of the host's QEMU process corresponding to the guest.
    (CVE-2015-3456)

    Red Hat would like to thank Jason Geffner of CrowdStrike for reporting     this issue.

    Users of the Red Hat Enterprise Virtualization Hypervisor are advised to     upgrade to this updated package.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- CVE-2015-3456: (VENOM) fdc: out-of-bounds fifo buffer     memory access (bz #1221152)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

qemu was updated to fix a security issue :

  - CVE-2015-3456: Fixed a buffer overflow in the floppy     drive emulation, which could be used to denial of     service attacks or potential code execution against the     host.

Jason Geffner discovered a buffer overflow in the emulated floppy disk drive, resulting in the potential execution of arbitrary code. This only affects HVM guests.

The remote host is running a version of qemu-kvm which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of VirtualBox which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of xen which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of qemu-kvm-rhev which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

The remote host is running a version of kvm which is vulnerable to an out-of-bounds memory access flaw, which can cause a crash or execution of arbitrary code on the host.

ID	Name	Product	Family	Published	Updated	Severity
83458	Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20150513) (Venom)	Nessus	Scientific Linux Local Security Checks	5/14/2015	9/28/2023	high
83510	FreeBSD : qemu, xen and VirtualBox OSE -- possible VM escape and code execution ('VENOM') (2780e442-fc59-11e4-b18b-6805ca1d3bb1) (Venom)	Nessus	FreeBSD Local Security Checks	5/18/2015	9/28/2023	high
83515	SuSE 11.3 Security Update : KVM (SAT Patch Number 10672)	Nessus	SuSE Local Security Checks	5/18/2015	9/28/2023	high
83430	RHEL 5 : kvm (RHSA-2015:1003)	Nessus	Red Hat Local Security Checks	5/13/2015	11/4/2024	critical
83435	Ubuntu 14.04 LTS : QEMU vulnerabilities (USN-2608-1)	Nessus	Ubuntu Local Security Checks	5/13/2015	8/28/2024	high
83536	RHEL 6 / 7 : rhev-hypervisor (RHSA-2015:1011)	Nessus	Red Hat Local Security Checks	5/19/2015	11/4/2024	critical
83791	Fedora 20 : qemu-1.6.2-14.fc20 (2015-8248) (Venom)	Nessus	Fedora Local Security Checks	5/26/2015	1/11/2021	high
83533	openSUSE Security Update : qemu (openSUSE-2015-363) (Venom)	Nessus	SuSE Local Security Checks	5/19/2015	9/28/2023	high
83532	Debian DSA-3262-1 : xen - security update (Venom)	Nessus	Debian Local Security Checks	5/19/2015	9/28/2023	high
801941	qemu-kvm < 1.5.3-86 el6 Venom Vulnerability	Log Correlation Engine	Generic			high
801944	VirtualBox < 4.3-4.3.28 Venom Vulnerability	Log Correlation Engine	Generic			high
801939	xen < 3.0.3-146 Venom Vulnerability	Log Correlation Engine	Generic			high
801942	qemu-kvm-rhev < 2.1.2-23 el7 Venom Vulnerability	Log Correlation Engine	Generic			high
801940	qemu-kvm < 0.12.1.2-2.448 el6 Venom Vulnerability	Log Correlation Engine	Generic			high
801943	kvm < 83-272 el5+ Venom Vulnerability	Log Correlation Engine	Generic			high

Detections

Analytics

Plugins Search

high

high

high

critical

high

critical

high

high

high

high

high

high

high

high

high