Venom - Lenovo Support US

2017-01-2300:00:00

support.lenovo.com

JSON

Lenovo Security Advisory: LEN-2015-046 **Potential Impact:**Escalation of Privileges Severity: High

Summary:
A buffer overflow vulnerability affecting the Floppy Disk Controller (FDC) emulation implemented in the QEMU component has been identified in the KVM/QEMU and Xen hypervisors. This vulnerability has been assigned CVE-2015-3456 and is being referred to as VENOM.

Description:
QEMU is a generic and open source machine emulator and virtualizer and is used as a foundation and hardware emulation layer for running virtual machines under the Xen and KVM/QEMU hypervisors.

A privileged guest user could use this flaw to crash the guest or, potentially, execute arbitrary code on the host with the privileges of the host’s QEMU process corresponding to the guest. It needs to be noted that even if a guest does not explicitly have a virtual floppy disk configured and attached, this issue is exploitable. The problem exists in the Floppy Disk Controller, which is initialized for every x86 and x86_64 guest regardless of the configuration and cannot be removed or disabled.

There is currently no known exploit that would make use of this vulnerability, but it is recommended that customers update to the latest code versions.

Mitigation Strategy for Customers (what you should do to protect yourself):
Update your product to the latest levels using the steps below:

Product Impact:
Please apply the latest versions of the following software updates:

Product Affected	Fix Version	Update Instructions	Software fix location:
LenovoEMC px12-400r IVX application	Version 1.0.10.33264 and later	See <https://download.lenovo.com/nasupdate/help/lifeline/4.1a/px12-400r/en_US/Content/software_update.html> for instructions on updating to the latest software version