UltratechHost Webmaster Forum
VENOM: QEMU vulnerability (CVE-2015-3456) - Printable Version

+- UltratechHost Webmaster Forum (http://forums.ultratechhost.com)
+-- Forum: UTH News (http://forums.ultratechhost.com/Forum-UTH-News)
+--- Forum: Announcements (http://forums.ultratechhost.com/Forum-Announcements)
+--- Thread: VENOM: QEMU vulnerability (CVE-2015-3456) (/Thread-VENOM-QEMU-vulnerability-CVE-2015-3456)



VENOM: QEMU vulnerability (CVE-2015-3456) - UltratechHost - 05-14-2015

A very serious security problem has been found in the virtual floppy drive QEMU's code used by many computer virtualization platforms including Xen, KVM, VirtualBox, and the native QEMU client. It is called VENOM vulnerability. How can I fix VENOM vulnerability and protect my Linux server against the attack? How do I verify that my server has been fixed against the VENOM vulnerability?

This is tagged as high severity security bug and it was announced on 13th May 2015. The VENOM vulnerability has existed since 2004, when the virtual Floppy Disk Controller was first added to the QEMU codebase. Since the VENOM vulnerability exists in the hypervisor’s codebase, the vulnerability is agnostic of the host operating system (Linux, Windows, Mac OS, etc.).
  

What is the VENOM security bug (CVE-2015-3456)?


Quote:An out-of-bounds memory access flaw was found in the way QEMU's virtual Floppy Disk Controller (FDC) handled FIFO buffer access while processing certain FDC commands. A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the hosting QEMU process.

This issue affects the versions of the kvm, xen, and QEMU packages while VMware, Hyper-V, and Bochs are unaffected. This issue affects all x86 and x86-64 based HVM Xen and QEMU/KVM guests, regardless of their machine type.

A list of affected Linux distros
  • RHEL (Red Hat Enterprise Linux) version 5.x, 6.x and 7.x
  • CentOS Linux version 5.x, 6.x and 7.x
  • OpenStack 5 for RHEL 6
  • OpenStack 4 for RHEL 6
  • OpenStack 5 for RHEL 7
  • OpenStack 6 for RHEL 7
  • Red Hat Enterprise Virtualization 3
  • Debian Linux code named stretch, sid, jessie, squeeze, and wheezy [and all other distro based on Debian]
  • SUSE Linux Enterprise Server 10 Service Pack 4 (SLES 10 SP3)
  • SUSE Linux Enterprise Server 10 Service Pack 4 (SLES 10 SP4)
  • SUSE Linux Enterprise Server 11 Service Pack 1 (SLES 11 SP1)
  • SUSE Linux Enterprise Server 11 Service Pack 2 (SLES 11 SP2)
  • SUSE Linux Enterprise Server 11 Service Pack 3 (SLES 11 SP3)
  • SUSE Linux Enterprise Server 12
  • SUSE Linux Enterprise Expanded Support 5, 6 and 7
Fix the VENOM vulnerability on a CentOS/RHEL/Fedora/Scientific Linux
Type the following yum command as the root user:


Code:
yum update

or

yum update qemu-kvm

Fix the VENOM vulnerability on a Debian/Ubuntu Linux


Code:
sudo apt-get clean
sudo apt-get update
sudo apt-get upgrade