The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-0999 advisory.

    [1.5.3-86.el7_1.2]
    - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219269]
    - Resolves: bz#1219269       (EMBARGOED CVE-2015-3456 qemu-kvm: qemu: floppy disk controller flaw [rhel-7.1.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - force the fifo access to be in bounds of the allocated     buffer This is CVE-2015-3456. [bug 21078935]     (CVE-2015-3456)

  - xen: limit guest control of PCI command register     Otherwise the guest can abuse that control to cause e.g.
    PCIe Unsupported Request responses (by disabling memory     and/or I/O decoding and subsequently causing [CPU side]     accesses to the respective address ranges), which     (depending on system configuration) may be fatal to the     host. This is CVE-2015-2756 / XSA-126.

    Conflicts: tools/ioemu-remote/hw/pass-through.c     (CVE-2015-2756)

  - Limit XEN_DOMCTL_memory_mapping hypercall to only     process up to 64 GFNs (or less) Said hypercall for large     BARs can take quite a while. As such we can require that     the hypercall MUST break up the request in smaller     values. Another approach is to add preemption to it -     whether we do the preemption using     hypercall_create_continuation or returning EAGAIN to     userspace (and have it re-invocate the call) - either     way the issue we cannot easily solve is that in     'map_mmio_regions' if we encounter an error we MUST call     'unmap_mmio_regions' for the whole BAR region. Since the     preemption would re-use input fields such as nr_mfns,     first_gfn, first_mfn - we would lose the original values
    - and only undo what was done in the current round (i.e.
    ignoring anything that was done prior to earlier     preemptions). Unless we re-used the return value as     'EAGAIN|nr_mfns_done<<10' but that puts a limit (since     the return value is a long) on the amount of nr_mfns     that can provided. This patch sidesteps this problem by :

  - Setting an hard limit of nr_mfns having to be 64 or     less.

  - Toolstack adjusts correspondingly to the nr_mfn limit.

  - If the there is an error when adding the toolstack will     call the remove operation to remove the whole region.
    The need to break this hypercall down is for large BARs     can take more than the guest (initial domain usually)     time-slice. This has the negative result in that the     guest is locked out for a long duration and is unable to     act on any pending events. We also augment the code to     return zero if nr_mfns instead of trying to the     hypercall. Suggested-by: Jan Beulich 

    This is CVE-2015-2752 / XSA-125. Conflicts:
    xen/arch/x86/domctl.c (CVE-2015-2752)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - force the fifo access to be in bounds of the allocated     buffer This is XSA-133. [bug 21078975] (CVE-2015-3456)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1011 advisory.

    The rhev-hypervisor packages provide a Red Hat Enterprise Virtualization     Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor     is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes     everything necessary to run and manage virtual machines: a subset of the     Red Hat Enterprise Linux operating environment and the Red Hat Enterprise     Virtualization Agent.

    Note: Red Hat Enterprise Virtualization Hypervisor is only available for     the Intel 64 and AMD64 architectures with virtualization extensions.

    An out-of-bounds memory access flaw was found in the way QEMU's virtual     Floppy Disk Controller (FDC) handled FIFO buffer access while processing     certain FDC commands. A privileged guest user could use this flaw to crash     the guest or, potentially, execute arbitrary code on the host with the     privileges of the host's QEMU process corresponding to the guest.
    (CVE-2015-3456)

    Red Hat would like to thank Jason Geffner of CrowdStrike for reporting     this issue.

    Users of the Red Hat Enterprise Virtualization Hypervisor are advised to     upgrade to this updated package.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- CVE-2015-3456: (VENOM) fdc: out-of-bounds fifo buffer     memory access (bz #1221152)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Privilege escalation via emulated floppy disk drive [XSA-133, CVE-2015-3456] (#1221153)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered in the qemu virtualisation solution :

CVE-2015-3456

Jason Geffner discovered a buffer overflow in the emulated floppy disk drive, resulting in the potential execution of arbitrary code.

Despite the end-of-life of qemu support in the old-oldstable distribution (squeeze-lts), this problem has been fixed in version 0.12.5+dfsg-3squeeze4 of the qemu source package due to its severity (the so-called VENOM vulnerability).

Further problems may still be present in the qemu package in the old-oldstable distribution (squeeze-lts) and users who need to rely on qemu are encouraged to upgrade to a newer version of Debian.

We recommend that you upgrade your qemu packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Three vulnerabilities have been fixed in the Debian squeeze-lts version of VirtualBox (package name: virtualbox-ose), a x86 virtualisation solution.

CVE-2015-0377

Avoid VirtualBox allowing local users to affect availability via unknown vectors related to Core, which might result in denial of service. (Other issue than CVE-2015-0418).

CVE-2015-0418

Avoid VirtualBox allowing local users to affect availability via unknown vectors related to Core, which might result in denial of service. (Other issue than CVE-2015-0377).

CVE-2015-3456

The Floppy Disk Controller (FDC) in QEMU, also used in VirtualBox and other virtualization products, allowed local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Gaia OS which is affected by a vulnerability in the virtual floppy drive code which may allow an attacker to escape a virtualized environment and obtain code execution on the underlying host.

The remote MiracleLinux 4 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2015-140:02 advisory.

    KVM (for Kernel-based Virtual Machine) is a full virtualization solution     for Linux on x86 hardware.
    Security issues fixed with this release:
    CVE-2015-3456

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
83445	Oracle Linux 7 : qemu-kvm (ELSA-2015-0999)	Nessus	Oracle Linux Local Security Checks	5/14/2015	11/1/2024	critical
83483	OracleVM 3.2 : xen (OVMSA-2015-0058) (Venom)	Nessus	OracleVM Local Security Checks	5/15/2015	1/4/2021	high
83484	OracleVM 2.2 : xen (OVMSA-2015-0059) (Venom)	Nessus	OracleVM Local Security Checks	5/15/2015	1/4/2021	high
83536	RHEL 6 / 7 : rhev-hypervisor (RHSA-2015:1011)	Nessus	Red Hat Local Security Checks	5/19/2015	11/4/2024	critical
83791	Fedora 20 : qemu-1.6.2-14.fc20 (2015-8248) (Venom)	Nessus	Fedora Local Security Checks	5/26/2015	1/11/2021	high
83829	Fedora 22 : qemu-2.3.0-4.fc22 (2015-8220) (Venom)	Nessus	Fedora Local Security Checks	5/27/2015	1/11/2021	high
83834	Fedora 21 : xen-4.4.2-4.fc21 (2015-8270) (Venom)	Nessus	Fedora Local Security Checks	5/27/2015	1/11/2021	high
84294	Debian DLA-248-1 : qemu security update (Venom)	Nessus	Debian Local Security Checks	6/22/2015	1/11/2021	high
84551	Debian DLA-268-1 : virtualbox-ose security update (Venom)	Nessus	Debian Local Security Checks	7/7/2015	1/11/2021	high
104999	Check Point Gaia Operating System VM escape and code execution (sk106060)(VENOM)	Nessus	Firewalls	12/4/2017	11/12/2025	high
289081	MiracleLinux 4 : qemu-kvm-0.12.1.2-2.448.AXS4.3 (AXSA:2015-140:02)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical

Detections

Analytics

Plugins Search

critical

high

high

critical

high

high

high

high

high

high

critical