CVE-2015-3456: Buffer Overflow
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FDCMDREADID, (2) FDCMDDRIVESPECIFICATIONCOMMAND, or other unspecified commands, aka VENOM.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3456?
CVE-2015-3456 is considered to have a medium severity level due to its potential to cause denial of service and execute arbitrary code.
How do I fix CVE-2015-3456?
To fix CVE-2015-3456, update QEMU to version 2.3.1 or later, or apply the relevant patches provided by your vendor.
Which versions of QEMU are affected by CVE-2015-3456?
Versions of QEMU up to and including 2.3.0 are affected by CVE-2015-3456.
Which platforms are impacted by CVE-2015-3456?
CVE-2015-3456 impacts platforms using QEMU, including Xen 4.5.x and earlier, and various versions of Red Hat OpenStack and Enterprise Virtualization.
Can CVE-2015-3456 lead to remote code execution?
While CVE-2015-3456 primarily leads to denial of service, it has potential for arbitrary code execution under certain conditions.