CVE-2015-3456

Published: May 13, 2015Modified: May 6, 2026

7.7

Vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Exploitability: 5.1 / Impact: 10.0

Source: NVD

Description

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

Affected (10)

Products: Qemu: Qemu · Redhat: Enterprise Linux, Enterprise Virtualization, Openstack · Xen: Xen

1 product

3 products

Enterprise Virtualization

Openstack

Xen

1 product

Xen

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Qemu Qemu	Up to 2.3.0

Configuration B

9 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 5
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Virtualization	Version 3.0
Redhat Openstack	Version 4.0
Redhat Openstack	Version 5.0
Redhat Openstack	Version 6.0
Redhat Openstack	Version 7.0
Xen Xen	Version 4.5.0

Related CWEs

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

References (96)

http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c

Source: cve@mitre.org

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10693

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=143229451215900&w=2

Source: cve@mitre.org

http://marc.info/?l=bugtraq&m=143387998230996&w=2

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-0998.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-0999.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-1000.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-1001.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-1002.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-1003.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-1004.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2015-1011.html

Source: cve@mitre.org

http://support.citrix.com/article/CTX201078

Source: cve@mitre.org

http://venom.crowdstrike.com/

Source: cve@mitre.org

http://www.debian.org/security/2015/dsa-3259

Source: cve@mitre.org

http://www.debian.org/security/2015/dsa-3262

Source: cve@mitre.org

http://www.debian.org/security/2015/dsa-3274

Source: cve@mitre.org

http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/74640

Source: cve@mitre.org

http://www.securitytracker.com/id/1032306

Source: cve@mitre.org

http://www.securitytracker.com/id/1032311

Source: cve@mitre.org

http://www.securitytracker.com/id/1032917

Source: cve@mitre.org

http://www.ubuntu.com/usn/USN-2608-1

Source: cve@mitre.org

http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm

Source: cve@mitre.org

http://xenbits.xen.org/xsa/advisory-133.html

Source: cve@mitre.org

https://access.redhat.com/articles/1444903

Source: cve@mitre.org

https://bto.bluecoat.com/security-advisory/sa95

Source: cve@mitre.org

https://kb.juniper.net/JSA10783

Source: cve@mitre.org

https://kc.mcafee.com/corporate/index?page=content&id=SB10118

Source: cve@mitre.org

https://security.gentoo.org/glsa/201602-01

Source: cve@mitre.org

https://security.gentoo.org/glsa/201604-03

Source: cve@mitre.org

https://security.gentoo.org/glsa/201612-27

Source: cve@mitre.org

https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/

Source: cve@mitre.org

https://support.lenovo.com/us/en/product_security/venom

Source: cve@mitre.org

https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10

Source: cve@mitre.org

https://www.exploit-db.com/exploits/37053/

Source: cve@mitre.org

https://www.suse.com/security/cve/CVE-2015-3456.html

Source: cve@mitre.org

http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c