A vulnerability was discovered in the qemu virtualisation solution :

CVE-2015-3456

Jason Geffner discovered a buffer overflow in the emulated floppy disk drive, resulting in the potential execution of arbitrary code.

Despite the end-of-life of qemu-kvm support in the old-oldstable distribution (squeeze-lts), this problem has been fixed in version 0.12.5+dfsg-5+squeeze11 of the qemu-kvm source package due to its severity (the so-called VENOM vulnerability).

Further problems may still be present in the qemu-kvm package in the old-oldstable distribution (squeeze-lts) and users who need to rely on qemu-kvm are encouraged to upgrade to a newer version of Debian.

We recommend that you upgrade your qemu-kvm packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM.

An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest. (CVE-2015-3456)

Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue.

All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Updated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the user-space component for running virtual machines using KVM.

An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest. (CVE-2015-3456)

Red Hat would like to thank Jason Geffner of CrowdStrike for reporting this issue.

All qemu-kvm users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0998 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for     Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the     user-space component for running virtual machines using KVM.

    An out-of-bounds memory access flaw was found in the way QEMU's virtual     Floppy Disk Controller (FDC) handled FIFO buffer access while processing     certain FDC commands. A privileged guest user could use this flaw to crash     the guest or, potentially, execute arbitrary code on the host with the     privileges of the host's QEMU process corresponding to the guest.
    (CVE-2015-3456)

    Red Hat would like to thank Jason Geffner of CrowdStrike for reporting     this issue.

    All qemu-kvm users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing this     update, shut down all running virtual machines. Once all virtual machines     have shut down, start them again for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1001 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for     Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the     user-space component for running virtual machines using KVM.

    An out-of-bounds memory access flaw was found in the way QEMU's virtual     Floppy Disk Controller (FDC) handled FIFO buffer access while processing     certain FDC commands. A privileged guest user could use this flaw to crash     the guest or, potentially, execute arbitrary code on the host with the     privileges of the host's QEMU process corresponding to the guest.
    (CVE-2015-3456)

    Red Hat would like to thank Jason Geffner of CrowdStrike for reporting     this issue.

    All qemu-kvm-rhev users are advised to upgrade to these updated packages,     which contain a backported patch to correct this issue. After installing     this update, shut down all running virtual machines. Once all virtual     machines have shut down, start them again for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2015-0998 advisory.

    [0.12.1.2-2.448.el6_6.3]
    - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219267]
    - Resolves: bz#1219267       (EMBARGOED CVE-2015-3456 qemu-kvm: qemu: floppy disk controller flaw [rhel-6.6.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest. (CVE-2015-3456)

After installing the updated packages, all running fully-virtualized guests must be restarted for this update to take effect.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - fdc: force the fifo access to be in bounds of the     allocated buffer During processing of certain commands     such as FD_CMD_READ_ID and     FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory     access could get out of bounds leading to memory     corruption with values coming from the guest. Fix this     by making sure that the index is always bounded by the     allocated memory. This is CVE-2015-3456.

    XSA-133 (CVE-2015-3456)

  - fdc: force the fifo access to be in bounds of the     allocated buffer During processing of certain commands     such as FD_CMD_READ_ID and     FD_CMD_DRIVE_SPECIFICATION_COMMAND the fifo memory     access could get out of bounds leading to memory     corruption with values coming from the guest. Fix this     by making sure that the index is always bounded by the     allocated memory. This is CVE-2015-3456.

    XSA-133 (CVE-2015-3456)

  - domctl: don't allow a toolstack domain to call     domain_pause on itself These DOMCTL subops were     accidentally declared safe for disaggregation in the     wake of XSA-77. This is XSA-127. (CVE-2015-2751)

  - xen: limit guest control of PCI command register     Otherwise the guest can abuse that control to cause e.g.
    PCIe Unsupported Request responses (by disabling memory     and/or I/O decoding and subsequently causing [CPU side]     accesses to the respective address ranges), which     (depending on system configuration) may be fatal to the     host. This is CVE-2015-2756 / XSA-126.

    Conflicts:
    tools/qemu-xen-traditional-dir/hw/pass-through.c     (CVE-2015-2756)

  - xen: limit guest control of PCI command register     Otherwise the guest can abuse that control to cause e.g.
    PCIe Unsupported Request responses (by disabling memory     and/or I/O decoding and subsequently causing [CPU side]     accesses to the respective address ranges), which     (depending on system configuration) may be fatal to the     host. This is CVE-2015-2756 / XSA-126. (CVE-2015-2756)

  - Limit XEN_DOMCTL_memory_mapping hypercall to only     process up to 64 GFNs (or less) Said hypercall for large     BARs can take quite a while. As such we can require that     the hypercall MUST break up the request in smaller     values. Another approach is to add preemption to it -     whether we do the preemption using     hypercall_create_continuation or returning EAGAIN to     userspace (and have it re-invocate the call) - either     way the issue we cannot easily solve is that in     'map_mmio_regions' if we encounter an error we MUST call     'unmap_mmio_regions' for the whole BAR region. Since the     preemption would re-use input fields such as nr_mfns,     first_gfn, first_mfn - we would lose the original values
    - and only undo what was done in the current round (i.e.
    ignoring anything that was done prior to earlier     preemptions). Unless we re-used the return value as     'EAGAIN|nr_mfns_done<<10' but that puts a limit (since     the return value is a long) on the amount of nr_mfns     that can provided. This patch sidesteps this problem by :

  - Setting an hard limit of nr_mfns having to be 64 or     less.

  - Toolstack adjusts correspondingly to the nr_mfn limit.

  - If the there is an error when adding the toolstack will     call the remove operation to remove the whole region.
    The need to break this hypercall down is for large BARs     can take more than the guest (initial domain usually)     time-slice. This has the negative result in that the     guest is locked out for a long duration and is unable to     act on any pending events. We also augment the code to     return zero if nr_mfns instead of trying to the     hypercall. Suggested-by: Jan Beulich 

    This is CVE-2015-2752 / XSA-125. (CVE-2015-2752)

Jason Geffner, CrowdStrike Senior Security Researcher reports :

VENOM, CVE-2015-3456, is a security vulnerability in the virtual floppy drive code used by many computer virtualization platforms. This vulnerability may allow an attacker to escape from the confines of an affected virtual machine (VM) guest and potentially obtain code-execution access to the host. Absent mitigation, this VM escape could open access to the host system and all other VMs running on that host, potentially giving adversaries significant elevated access to the host's local network and adjacent systems.

Jason Geffner discovered a buffer overflow in the emulated floppy disk drive, resulting in the potential execution of arbitrary code. This only affects HVM guests.

ID	Name	Product	Family	Published	Updated	Severity
84295	Debian DLA-249-1 : qemu-kvm security update (Venom)	Nessus	Debian Local Security Checks	6/22/2015	1/11/2021	high
83418	CentOS 6 : qemu-kvm (CESA-2015:0998) (Venom)	Nessus	CentOS Local Security Checks	5/13/2015	9/28/2023	high
83419	CentOS 7 : qemu-kvm (CESA-2015:0999) (Venom)	Nessus	CentOS Local Security Checks	5/13/2015	9/28/2023	high
83425	RHEL 6 : qemu-kvm (RHSA-2015:0998)	Nessus	Red Hat Local Security Checks	5/13/2015	11/4/2024	critical
83426	RHEL 7 : qemu-kvm (RHSA-2015:0999) (Venom)	Nessus	Red Hat Local Security Checks	5/13/2015	9/28/2023	high
83428	RHEL 6 : qemu-kvm-rhev (RHSA-2015:1001)	Nessus	Red Hat Local Security Checks	5/13/2015	11/4/2024	critical
83444	Oracle Linux 6 : qemu-kvm (ELSA-2015-0998)	Nessus	Oracle Linux Local Security Checks	5/14/2015	10/22/2024	critical
83460	Scientific Linux Security Update : xen on SL5.x i386/x86_64 (20150513) (Venom)	Nessus	Scientific Linux Local Security Checks	5/14/2015	9/28/2023	high
83482	OracleVM 3.3 : xen (OVMSA-2015-0057) (Venom)	Nessus	OracleVM Local Security Checks	5/15/2015	1/4/2021	high
83510	FreeBSD : qemu, xen and VirtualBox OSE -- possible VM escape and code execution ('VENOM') (2780e442-fc59-11e4-b18b-6805ca1d3bb1) (Venom)	Nessus	FreeBSD Local Security Checks	5/18/2015	9/28/2023	high
83532	Debian DSA-3262-1 : xen - security update (Venom)	Nessus	Debian Local Security Checks	5/19/2015	9/28/2023	high

Detections

Analytics

Plugins Search

high

high

high

critical

high

critical

critical

high

high

high

high