Lucene search

K
lenovoLenovoLENOVO:PS500033-VENOM-NOSID
HistoryJan 23, 2017 - 12:00 a.m.

Venom - Lenovo Support US

2017-01-2300:00:00
support.lenovo.com
22
vulnerability
floppy disk controller
venom
lenovo
privileges
escalation
qemu
xen
kvm
buffer overflow

EPSS

0.001

Percentile

41.0%

Lenovo Security Advisory: LEN-2015-046 **Potential Impact:**Escalation of Privileges Severity: High

Summary:
A buffer overflow vulnerability affecting the Floppy Disk Controller (FDC) emulation implemented in the QEMU component has been identified in the KVM/QEMU and Xen hypervisors. This vulnerability has been assigned CVE-2015-3456 and is being referred to as VENOM.

Description:
QEMU is a generic and open source machine emulator and virtualizer and is used as a foundation and hardware emulation layer for running virtual machines under the Xen and KVM/QEMU hypervisors.

A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host’s QEMU process corresponding to the guest. It needs to be noted that even if a guest does not explicitly have a virtual floppy disk configured and attached, this issue is exploitable. The problem exists in the Floppy Disk Controller, which is initialized for every x86 and x86_64 guest regardless of the configuration and cannot be removed or disabled.

There is currently no known exploit that would make use of this vulnerability, but it is recommended that customers update to the latest code versions.

Mitigation Strategy for Customers (what you should do to protect yourself):
Update your product to the latest levels using the steps below:

Product Impact:
Please apply the latest versions of the following software updates:

Product Affected Fix Version Update Instructions **Software fix location: **
LenovoEMC px12-400r IVX application Version 1.0.10.33264 and later See <https://download.lenovo.com/nasupdate/help/lifeline/4.1a/px12-400r/en_US/Content/software_update.html&gt; for instructions on updating to the latest software version

http://lifelineapps.com/?user_lang=en&device=px12450r&version=&category=&sort=1&redirect_url=

LenovoEMC px12-450r IVX application | Version 1.0.10.33264 and later | See <https://download.lenovo.com/nasupdate/help/lifeline/4.1a/px12-450r/en_US/Content/software_update.html&gt; for instructions on updating to the latest software version | http://lifelineapps.com/?user_lang=en&device=px12450r&version=&category=&sort=1&redirect_url=

Other information and references:

Revision History:

Revision

|

Date

|

Description

—|—|—
1.0 |** 20 Jul 2015**|** Initial release**