Red Hat Product Security is now aware of a 'buffer overflow' vulnerability within the QEMU system emulator, which is widely installed and used for virtualization purposes on Linux systems. QEMU is also used by Red Hat’s cloud and virtualization products.
The vulnerability is known as VENOM and is assigned the identifier CVE-2015-3456.
This vulnerability affects the Floppy Disk Controller (FDC) emulation implemented in QEMU and could cause VM guests to crash the host's hypervisor and potentially facilitate arbitrary code execution on the host via guests. Even if the guest does not explicitly enable an FDC, all x86 and x86_64 guests are vulnerable.
For more more detailed information, do take a look at Redhat Security Blog: VENOM, don't get bitten
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment