CVE-2015-3456 The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbi...
HighCVSS 7.7
EPSS 15.3%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/qemu(Debian:12) | < 1:2.3+dfsg-3 | 1:2.3+dfsg-3 |
| debian/qemu(Debian:13) | < 1:2.3+dfsg-3 | 1:2.3+dfsg-3 |
| debian/qemu(Debian:14) | < 1:2.3+dfsg-3 | 1:2.3+dfsg-3 |
| debian/xen(Debian:12) | < 4.4.0-1 | 4.4.0-1 |
| debian/xen(Debian:13) | < 4.4.0-1 | 4.4.0-1 |
| debian/xen(Debian:14) | < 4.4.0-1 | 4.4.0-1 |
| qemu | <= 2.3.0 | No fix listed |
| redhat enterprise virtualization | = 3.0 | No fix listed |
| redhat openstack | = 4.0 | No fix listed |
| redhat openstack | = 5.0 | No fix listed |
| redhat openstack | = 6.0 | No fix listed |
| redhat openstack | = 7.0 | No fix listed |
| redhat enterprise linux | = 5 | No fix listed |
| redhat enterprise linux | = 6.0 | No fix listed |
| redhat enterprise linux | = 7.0 | No fix listed |
| Xen | = 4.5.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-3456 vendor-advisory
- git.qemu.org
- kb.juniper.net
- FEDORA-2015-8249 vendor-advisory
- SUSE-SU-2015:0889 vendor-advisory
- openSUSE-SU-2015:0893 vendor-advisory
- openSUSE-SU-2015:0894 vendor-advisory
- SUSE-SU-2015:0923 vendor-advisory
- SUSE-SU-2015:0927 vendor-advisory
- SUSE-SU-2015:0929 vendor-advisory
- SUSE-SU-2015:0896 vendor-advisory
- openSUSE-SU-2015:0983 vendor-advisory
- openSUSE-SU-2015:1400 vendor-advisory
- HPSBMU03336 vendor-advisory
- HPSBMU03349 vendor-advisory
- RHSA-2015:0998 vendor-advisory
- RHSA-2015:0999 vendor-advisory
- RHSA-2015:1000 vendor-advisory
- RHSA-2015:1001 vendor-advisory
- RHSA-2015:1002 vendor-advisory
- RHSA-2015:1003 vendor-advisory
- RHSA-2015:1004 vendor-advisory
- RHSA-2015:1011 vendor-advisory
- support.citrix.com
- venom.crowdstrike.com
- DSA-3259 vendor-advisory
- DSA-3262 vendor-advisory
- DSA-3274 vendor-advisory
- www.fortiguard.com
- www.oracle.com
- 74640 vdb-entry
- 1032306 vdb-entry
- 1032311 vdb-entry
- 1032917 vdb-entry
- USN-2608-1 vendor-advisory
- www1.huawei.com
- xenbits.xen.org
- access.redhat.com
- bto.bluecoat.com
- kb.juniper.net
- kc.mcafee.com
- GLSA-201602-01 vendor-advisory
- GLSA-201604-03 vendor-advisory
- GLSA-201612-27 vendor-advisory
- securityblog.redhat.com
- support.lenovo.com
- www.arista.com
- 37053 exploit
- www.suse.com