CVE Feed

Dashboard / CVE / CVE-2015-3456

CVE-2015-3456

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

Published:May 13, 2015

Last Modified:Apr 12, 2025

EPS:May 13, 2015

EPSS Score:0.3391

CVSS Score:7.7

Affected Products

Vendor

Product

Action

Vendor

Qemu

Product

Qemu

Qemu

Qemu

Vendor

Redhat

Product

Enterprise Linux

Redhat

Enterprise Linux

Vendor

Redhat

Product

Enterprise Virtualization

Redhat

Enterprise Virtualization

Vendor

Redhat

Product

Openstack

Redhat

Openstack

Vendor

Redhat

Product

Rhel Eus

Redhat

Rhel Eus

Vendor

Redhat

Product

Rhel Virtualization

Redhat

Rhel Virtualization

Vendor

Xen

Product

Xen

Xen

Xen

Exploits

https://www.exploit-db.com/exploits/37053 https://github.com/orf53975/poisonfrog https://github.com/vincentbernat/cve-2015-3456

Common Weakness Enumeration

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-10 Buffer Overflow via Environment Variables

CAPEC-100 Overflow Buffers

CAPEC-123 Buffer Manipulation

CAPEC-14 Client-side Injection-induced Buffer Overflow

CAPEC-24 Filter Failure through Buffer Overflow

CAPEC-42 MIME Conversion

CAPEC-44 Overflow Binary Resource File

CAPEC-45 Buffer Overflow via Symbolic Links

CAPEC-46 Overflow Variables and Tags

CAPEC-47 Buffer Overflow via Parameter Expansion

CAPEC-8 Buffer Overflow in an API Call

CAPEC-9 Buffer Overflow in Local Command-Line Utilities

Related CVEs

CVE-2026-6426 (CVSS 4.4) — A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination b…

CVE-2026-51082 (CVSS 7.2) — A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-…

CVE-2026-3842 (CVSS 7.8) — A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write d…

CVE-2026-12080 (CVSS 7.3) — A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the g…

CVE-2026-3195 (CVSS 7.4) — A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pc…

CVE-2026-3196 (CVSS 5.5) — An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A m…

CVE-2025-54566 (CVSS 4.2) — hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26…

CVE-2025-54567 (CVSS 4.2) — hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-202…

CVE-2024-6519 (CVSS 8.2) — A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue ca…

CVE-2024-8354 (CVSS 5.5) — A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when …

References

http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10693

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html

http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html

http://marc.info/?l=bugtraq&m=143229451215900&w=2

http://marc.info/?l=bugtraq&m=143387998230996&w=2

http://rhn.redhat.com/errata/RHSA-2015-0998.html

http://rhn.redhat.com/errata/RHSA-2015-0999.html

http://rhn.redhat.com/errata/RHSA-2015-1000.html

http://rhn.redhat.com/errata/RHSA-2015-1001.html

http://rhn.redhat.com/errata/RHSA-2015-1002.html

http://rhn.redhat.com/errata/RHSA-2015-1003.html

http://rhn.redhat.com/errata/RHSA-2015-1004.html

http://rhn.redhat.com/errata/RHSA-2015-1011.html

http://support.citrix.com/article/CTX201078

http://venom.crowdstrike.com/

http://www.debian.org/security/2015/dsa-3259

http://www.debian.org/security/2015/dsa-3262

http://www.debian.org/security/2015/dsa-3274

http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

http://www.securityfocus.com/bid/74640

http://www.securitytracker.com/id/1032306

http://www.securitytracker.com/id/1032311

http://www.securitytracker.com/id/1032917

http://www.ubuntu.com/usn/USN-2608-1

http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm

http://xenbits.xen.org/xsa/advisory-133.html

https://access.redhat.com/articles/1444903

https://bto.bluecoat.com/security-advisory/sa95

https://kb.juniper.net/JSA10783

https://kc.mcafee.com/corporate/index?page=content&id=SB10118

https://security.gentoo.org/glsa/201602-01

https://security.gentoo.org/glsa/201604-03

https://security.gentoo.org/glsa/201612-27

https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/

https://support.lenovo.com/us/en/product_security/venom

https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10

https://www.exploit-db.com/exploits/37053/

https://www.suse.com/security/cve/CVE-2015-3456.html

http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10693

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158072.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00009.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00013.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00014.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00021.html

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00042.html

http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html

http://lists.opensuse.org/opensuse-updates/2015-08/msg00021.html

http://marc.info/?l=bugtraq&m=143229451215900&w=2

http://marc.info/?l=bugtraq&m=143387998230996&w=2

http://rhn.redhat.com/errata/RHSA-2015-0998.html

http://rhn.redhat.com/errata/RHSA-2015-0999.html

http://rhn.redhat.com/errata/RHSA-2015-1000.html

http://rhn.redhat.com/errata/RHSA-2015-1001.html

http://rhn.redhat.com/errata/RHSA-2015-1002.html

http://rhn.redhat.com/errata/RHSA-2015-1003.html

http://rhn.redhat.com/errata/RHSA-2015-1004.html

http://rhn.redhat.com/errata/RHSA-2015-1011.html

http://support.citrix.com/article/CTX201078

http://venom.crowdstrike.com/

http://www.debian.org/security/2015/dsa-3259

http://www.debian.org/security/2015/dsa-3262

http://www.debian.org/security/2015/dsa-3274

http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

http://www.securityfocus.com/bid/74640

http://www.securitytracker.com/id/1032306

http://www.securitytracker.com/id/1032311

http://www.securitytracker.com/id/1032917

http://www.ubuntu.com/usn/USN-2608-1

http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm

http://xenbits.xen.org/xsa/advisory-133.html

https://access.redhat.com/articles/1444903

https://bto.bluecoat.com/security-advisory/sa95

https://kb.juniper.net/JSA10783

https://kc.mcafee.com/corporate/index?page=content&id=SB10118

https://security.gentoo.org/glsa/201602-01

https://security.gentoo.org/glsa/201604-03

https://security.gentoo.org/glsa/201612-27

https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/

https://support.lenovo.com/us/en/product_security/venom

https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10

https://www.exploit-db.com/exploits/37053/

https://www.suse.com/security/cve/CVE-2015-3456.html

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High