Buffer overflow in Xen - CVE-2015-3456

Vulnerability identifier: #VU5580

CSH Severity: Critical

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-3456

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to buffer overflow in the Floppy Disk Controller (FDC) emulation. A remote attacker can send specially crafted FDC commands, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in full control of the vulnerable system.

Note: the vulnerability was being actively exploited.

Xen
Red Hat Virtualization
Debian Linux
Arch Linux
HPE Helion Openstack
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Workstation
Fedora
Red Hat Enterprise Linux EUS Compute Node
SUSE Linux
Junos OS
Helion CloudSystem
qemu (Alpine package)
xen (Alpine package)
qemu
xen
IBM Systems Director

Install update from vendor's website.

HPE Helion Openstack - update to 1.1.1
qemu (Alpine package) - update to 1.4.2-r2
xen (Alpine package) - update to 4.4.2-r1
Junos OS - addressed in versions 13.2X51-D40, 14.1X53-D30, 18.4R2-S10, 18.4R3-S10, 19.1R3-S7, 19.1R3-S9, 19.2R1-S8, 19.2R3-S4, 19.3R3-S4, 19.3R3-S6, 19.4R2-S6, 19.4R2-S7, 19.4R3-S6, 19.4R3-S9, 20.1R3-S3, 20.1R3-S4, 20.2R3-S3, 20.2R3-S5, 20.3R3-S3, 20.3R3-S4, 20.4R3, 20.4R3-S4, 21.1R2, 21.1R3-S3, 21.2R1, 21.2R3-S1, 21.3R3-S1, 21.4R2, 22.1R2, 22.2R1
qemu - addressed in versions 2.0.0-1.el7.5, 2.1.3-7.fc21, 2.3.0-4.fc22
xen - addressed in versions 4.4.2-4.fc21, 4.5.0-9.fc22

• Exploit #2100 - venom (A VENOM (CVE-2015-3456) Exploit / PoC written in C.) (March 18, 2020)
• Exploit #982 - QEMU - Floppy Disk Controller (FDC) (PoC) (March 18, 2020)

• http://git.qemu.org/?p=qemu.git;a=commitdiff

• Remote code execution in Xen
• Arch Linux update for qemu
• Debian update for virtualbox
• Debian update for xen
• SUSE Linux update for KVM
• SUSE Linux update for Xen
• OpenSUSE Linux update for qemu
• OpenSUSE Linux update for qemu
• SUSE Linux update for KVM
• Red Hat update for rhev-hypervisor
• Red Hat update for kvm
• Red Hat update for xen
• Red Hat update for qemu-kvm-rhev
• Red Hat update for qemu-kvm-rhev
• Red Hat update for qemu-kvm
• Red Hat update for qemu-kvm
• SUSE Linux update for qemu
• Buffer overflow in qemu (Alpine package)
• Buffer overflow in xen (Alpine package)
• Buffer overflow in HP Helion OpenStack
• Buffer overflow in HP Helion CloudSystem
• Junos OS update for QEMU
• Fedora 22 update for xen
• Fedora 21 update for xen
• Fedora 21 update for qemu
• Fedora 22 update for qemu
• Fedora EPEL 7 update for qemu