Posted By Shivniel Gounder

The vulnerability is agnostic of the host operating system

Jason Geffner, CrowdStrike Senior Security Researcher, discovered a new vulnerability which potentials puts millions users at risk. The guest operating system communicates with the FDC by sending commands such as seek, read, write, format, etc. to the FDC’s input/output port. QEMU’s virtual FDC uses a fixed-size buffer for storing these commands and their associated data parameters. The FDC keeps track of how much data to expect for each command and, after all expected data for a given command is received from the guest system, the FDC executes the command and clears the buffer for the next command.

This buffer reset is performed immediately at the completion of processing for all FDC commands, except for two of the defined commands. An attacker can send these commands and specially crafted parameter data from the guest system to the FDC to overflow the data buffer and execute arbitrary code in the context of the host’s hypervisor process.
The VENOM vulnerability has existed since 2004, when the virtual Floppy Disk Controller was first added to the QEMU codebase. Good news is that VENOM has not been seen in the wild, but that does not necessarily mean someone might not have used it before.

Amazon Web Services released a statement, that their customers are not at risk.

We are aware of the QEMU security issue assigned CVE-2015-3456, also known as “VENOM,” which impacts various virtualized platforms. There is no risk to AWS customer data or instances.

Rackspace also released a statement saying their customers are not at risk as well.

…applied the appropriate patch to our infrastructure and are working with customers to remediate fully this vulnerability.

Google on the another hand said they “don’t use vulnerable software” so they are not at risk as well. Since Microsoft Azure users their own program, most MS customers are protected.

Admins Patch Your System

If you administer a system running Xen, KVM, or the native QEMU client, review and apply the latest patches developed to address this vulnerability.

If you have a vendor service or device using one of the affected hypervisors, contact the vendor’s support team to see if their staff has applied the latest VENOM patches.