Ubuntu Wiki

QEMU buffer overflow in the floppy disk controller (CVE-2015-3456 aka VENOM)

It was discovered that a buffer overflow existed in the virtual floppy disk controller of QEMU. An attacker could use this issue to cause QEMU to crash or execute arbitrary code in the host's QEMU process.

This issue is mitigated in a couple ways on Ubuntu when using libvirt to manage QEMU virtual machines, which includes OpenStack's use of QEMU. The QEMU process in the host environment is owned by a special libvirt-qemu user which helps to limit access to resources in the host environment. Additionally, the QEMU process is confined by an AppArmor profile that significantly lessens the impact of a vulnerability such as VENOM by reducing the host environment's attack surface.

A fix for this issue has been committed in the upstream QEMU source code tracker. Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 14.10, and Ubuntu 15.04 are affected. To address the issue, ensure that qemu-kvm 1.0+noroms-0ubuntu14.22 (Ubuntu 12.04 LTS), qemu 2.0.0+dfsg-2ubuntu1.11 (Ubuntu 14.04 LTS), qemu 2.1+dfsg-4ubuntu6.6 (Ubuntu 14.10), qemu 1:2.2+dfsg-5expubuntu9.1 (Ubuntu 15.04) are installed. These updates were announced in USN 2608-1.

Timeline

• 2015 Apr 30: The Ubuntu Security Team is notified by CrowdStrike via the linux-distros list, with a pending CRD of 2015-05-13 12:00 UTC

• 2015 May 13: Issue became public a few hours before the CRD via twitter and reddit with links to CrowdStrike's VENOM page

• 2015 May 13: CrowdStrike sent a notification email to the oss-security mailing list

• 2015 May 13: Ubuntu released security updates (USN 2608-1)

Cloud Archive updates

• Ubuntu Cloud Archive Icehouse pocket for 12.04: <IN PROGRESS>

• Ubuntu Cloud Archive Kilo pocket for 14.04: <IN PROGRESS>

CategoryTemplate