VENOM Vulnerability Analysis

The VENOM vulnerability (CVE-2015-3456) is a type of vulnerability that exists in the virtual floppy drive code used by many virtualization systems. It allows an attacker to escape from the sandbox of the VM guest and potentially obtain code-execution level access to the Guest operating system, exposing unauthenticated access to IP or Intellectual Property.

Contents
Executive Summary...............................................................................................................................1
Technical Description............................................................................................................................1
Vulnerability Description..................................................................................................................1
Attack Vector....................................................................................................................................2
Exploitation Scenario........................................................................................................................2
Mitigation..........................................................................................................................................2
Remediation.......................................................................................................................................3
References.............................................................................................................................................3
Executive Summary
CVE-2015-3456 or more commonly known as the VENOM vulnerability is a type of
vulnerability which exsts in the virtual floppy drive code that was being used by many
vrtualization systems. This particular vulnerability allows an attacker to excape from the
sandbox of the VM guest to potentntially obtain a code-execution level access to the Guest
operating system. If there is no blocking mechanism in place, an attack that takes place via
this vulnerability would access the host operating system and any subsequent VMs running
on this particular host. Successful exploitation of VM vulnerability could potentially expose
unauthenticated access to IP or Intellectual Property of the Corporate and additionally reveal
personally identifiable and sensitive information that affects the lives of millions of users
worldwide. These users are those that make use of VM or use VPS services involving shared
computer resources, storage, and connectivity and security services.
Technical Description
Vulnerability Description
VENOM stands for Virtualized Environtment Neglected Operation Manipulation and is a
zero day flow that takes full advantage of the ‘Virtual Floppy Disk Drive Controller’. This
vulnerability potentially allows the attacker to exit the boundaries of the VM environment
and spill over to the host operating system including other VMs on that host. Crowdstrike, a
renowned security intelligence corporation has discovered this vulnerability and explains that
the attacker has first to gain root level privileges of the system in order to make use of this
vulnerability. This is a major barrier to this particular exploitation, however it is not

impossible. The virtualization systems that have been infected currently includes the QEMU,
the KVM, the XEN and the VirtualBox. At the moment they do not include the virtualization
products provided by VMWare and Microsoft. According to the security intelligence firm,
the attacker could trigger this vulnerability by sending commands with specially crafted
parameter data to the guest system’s Floppy Disk Controller in order to cause the buffer
overflow thereby allowing to execute the arbitrary code in the guest’s host system. The
vulnerability is exceptionally dangerous because once the attacker could execute this on a
wide variety of virtualized machines.
Attack Vector
In order to exploit this vulnerability, the attacker would have to access of virtual machine
physically or by through some other pre-exploited means and then execute the code on their
choice of virtual machine. The attacker simultaneously also needs to have administrator or
root level privileges to the system. At this point, the attacker could have potentially control of
the host and thereby could potentially leverage that exploited host to launch a series of
attacks within the network. Or in other words, this attack cannot be pulled remotely. Many
corporate and business environments are virtually isolated from public and thereby are safe
from such attacks. As such, the attack is quite similar to privilege escalation attack wherein
the attacker needs to have an initial foothold before he or she could launch an attack.
Exploitation Scenario
Assuming that the attacker has somehow gained an initial foothold into the victim’s system,
the exploitation works in the following way :
a) The attacker first sends in the malicious request to the virtual floppy controller present
in the attacker’s VM.
b) The attacker then exploits VENOM in order to escape the VM.
c) The attacker then moves laterally into other VMs present in the host machine.
d) The attacker gains access to host’s network which then further helps him in gaining
access to credentials, private and secure data, and personally identifiable information
and so on.
Mitigation
 Always making sure the Hypervisor has been kept up to date.

 Making sure that the Hypervisor drivers present inside the Virtual Machine are
updated as well.
 Limiting access to and from the appliance management interface and combining this
with a firewall.
 Making use of strong passwords.
 Ensuring only trust administrators access the systems.
Remediation
To completely eliminate the possibility of any exploitation for these hypervisors such as
QEMU, the Xen, KVM and others, the administrator would need to apply the patches issued
by the companies in response to this threat. The same updates would need to be installed by
the Package manager known as Yum. Once the update has been done using Yum, the guest
machines need to be powered off completely instead of just being suspended and then
restarted again to make sure the update takes effect. Also, the guests can be migrated away
and then having the guests migrated back.
References
[1]C. Communications), E. Officer), E. Marketing), J. Communications), C. Mark
Nunnikhoven (Vice President, S. Rik Ferguson (VP and W. Strategies), "Understanding
the VENOM Vulnerability -", Blog.trendmicro.com, 2018. [Online]. Available:
https://blog.trendmicro.com/understanding-the-venom-vulnerability/. [Accessed: 24-
Apr- 2018].
[2]"VENOM virtual vuln proves less poisonous than first feared", Theregister.co.uk, 2018.
[Online]. Available: https://www.theregister.co.uk/2015/05/14/venom_analysis/.
[Accessed: 24- Apr- 2018].
[3]"VENOM: QEMU vulnerability (CVE-2015-3456) - Red Hat Customer
Portal", Access.redhat.com, 2018. [Online]. Available:
https://access.redhat.com/articles/1444903. [Accessed: 24- Apr- 2018].
[4]"VENOM: QEMU vulnerability (CVE-2015-3456) - Red Hat ...". [Online]. Available:
https://access.redhat.com/articles/1444903. [Accessed: 2018].
[5]"VENOM Vulnerability CVE-2015-3456 Explained [VIDEO] | Rapid7". [Online].
Available: https://www.rapid7.com/resources/venom-vulnerability-explained.
[Accessed: 2018].