The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM…
Priority MEDIUM 50CWE-119Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- Partial Red Hat: 25 fixed, 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.
Summary
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
Why it matters now
EPSS 0.15275 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial Red Hat: 9 advisoriesRed Hat: 25 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* | up to 2.3.0 | Vulnerable | QEMU |
| cpe:2.3:a:redhat:enterprise_virtualization:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:* | 5 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:* | 4.5.0 | Vulnerable | Xen |
- cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* Versions up to 2.3.0 Vulnerable ·QEMU
- cpe:2.3:a:redhat:enterprise_virtualization:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:* Versions 4.5.0 Vulnerable ·Xen
Remediation
Red Hat 9 advisories
- RHSA-2015:1031 Released 2015-05-27 · Red Hat rating Importantqemu-kvm security update
- Red Hat Enterprise Linux HPC Node EUS (v. 6.5) qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15, qemu-img-2:0.12.1.2-2.415.el6_5.15, qemu-kvm-2:0.12.1.2-2.415.el6_5.15 +1
- Red Hat Enterprise Linux Server EUS (v. 6.5) qemu-guest-agent-2:0.12.1.2-2.415.el6_5.15, qemu-img-2:0.12.1.2-2.415.el6_5.15, qemu-kvm-2:0.12.1.2-2.415.el6_5.15 +1
- RHSA-2015:1011 Released 2015-05-15 · Red Hat rating Importantrhev-hypervisor security update
- RHEL 7-based RHEV-H rhev-hypervisor7-7.1-20150512.1.el7ev
- RHEV Hypervisor for RHEL-6 rhev-hypervisor6-6.6-20150512.0.el6ev
- RHSA-2015:0999 Released 2015-05-13 · Red Hat rating Importantqemu-kvm security update
- Red Hat Enterprise Linux Client (v. 7) libcacard-10:1.5.3-86.el7_1.2, qemu-img-10:1.5.3-86.el7_1.2, qemu-kvm-10:1.5.3-86.el7_1.2 +2
- Red Hat Enterprise Linux Client Optional (v. 7) libcacard-devel-10:1.5.3-86.el7_1.2, libcacard-tools-10:1.5.3-86.el7_1.2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) libcacard-10:1.5.3-86.el7_1.2, libcacard-devel-10:1.5.3-86.el7_1.2, libcacard-tools-10:1.5.3-86.el7_1.2 +4
- Red Hat Enterprise Linux Server (v. 7) libcacard-10:1.5.3-86.el7_1.2, qemu-img-10:1.5.3-86.el7_1.2, qemu-kvm-10:1.5.3-86.el7_1.2 +2
- Red Hat Enterprise Linux Server Optional (v. 7) libcacard-10:1.5.3-86.el7_1.2, libcacard-10:1.5.3-86.el7_1.2.ppc, libcacard-devel-10:1.5.3-86.el7_1.2 +2
- Red Hat Enterprise Linux Workstation (v. 7) libcacard-10:1.5.3-86.el7_1.2, qemu-img-10:1.5.3-86.el7_1.2, qemu-kvm-10:1.5.3-86.el7_1.2 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) libcacard-devel-10:1.5.3-86.el7_1.2, libcacard-tools-10:1.5.3-86.el7_1.2
Show 6 more Red Hat advisories
- RHSA-2015:1000 Released 2015-05-13 · Red Hat rating Importantqemu-kvm-rhev security update
- RHEV-H and VDSM for 7 Hosts libcacard-devel-rhev-10:2.1.2-23.el7_1.3, libcacard-rhev-10:2.1.2-23.el7_1.3, libcacard-tools-rhev-10:2.1.2-23.el7_1.3 +4
- RHSA-2015:1001 Released 2015-05-13 · Red Hat rating Importantqemu-kvm-rhev security update
- RHEV Agents (vdsm) qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3, qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3, qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3
- RHSA-2015:1002 Released 2015-05-13 · Red Hat rating Importantxen security update
- Red Hat Enterprise Linux (v. 5 server) xen-3.0.3-146.el5_11, xen-libs-3.0.3-146.el5_11, xen-libs-3.0.3-146.el5_11.i386 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) xen-3.0.3-146.el5_11, xen-libs-3.0.3-146.el5_11, xen-libs-3.0.3-146.el5_11.i386
- Red Hat Enterprise Linux Desktop Multi OS (v. 5 client) xen-3.0.3-146.el5_11, xen-3.0.3-146.el5_11.i386, xen-devel-3.0.3-146.el5_11 +1
- Red Hat Enterprise Linux Virtualization (v. 5 server) xen-3.0.3-146.el5_11, xen-3.0.3-146.el5_11.i386, xen-3.0.3-146.el5_11.ia64 +3
- RHSA-2015:1003 Released 2015-05-13 · Red Hat rating Importantkvm security update
- Red Hat Enterprise Linux Desktop Multi OS (v. 5 client) kmod-kvm-83-272.el5_11, kmod-kvm-debug-83-272.el5_11, kvm-83-272.el5_11 +2
- Red Hat Enterprise Linux Virtualization (v. 5 server) kmod-kvm-83-272.el5_11, kmod-kvm-debug-83-272.el5_11, kvm-83-272.el5_11 +2
- RHSA-2015:1004 Released 2015-05-13 · Red Hat rating Importantqemu-kvm-rhev security update
- Red Hat Enterprise Linux OpenStack Platform 4.0 qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3, qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3, qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3
- Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 qemu-img-rhev-2:0.12.1.2-2.448.el6_6.3, qemu-kvm-rhev-2:0.12.1.2-2.448.el6_6.3, qemu-kvm-rhev-tools-2:0.12.1.2-2.448.el6_6.3
- Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 libcacard-devel-rhev-10:2.1.2-23.el7_1.3, libcacard-rhev-10:2.1.2-23.el7_1.3, libcacard-tools-rhev-10:2.1.2-23.el7_1.3 +4
- Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 libcacard-devel-rhev-10:2.1.2-23.el7_1.3, libcacard-rhev-10:2.1.2-23.el7_1.3, libcacard-tools-rhev-10:2.1.2-23.el7_1.3 +4
- RHSA-2015:0998 Released 2015-05-13 · Red Hat rating Importantqemu-kvm security update
- Red Hat Enterprise Linux Desktop (v. 6) qemu-guest-agent-2:0.12.1.2-2.448.el6_6.3, qemu-img-2:0.12.1.2-2.448.el6_6.3, qemu-kvm-2:0.12.1.2-2.448.el6_6.3 +1
- Red Hat Enterprise Linux HPC Node (v. 6) qemu-guest-agent-2:0.12.1.2-2.448.el6_6.3, qemu-img-2:0.12.1.2-2.448.el6_6.3, qemu-kvm-2:0.12.1.2-2.448.el6_6.3 +1
- Red Hat Enterprise Linux Server (v. 6) qemu-guest-agent-2:0.12.1.2-2.448.el6_6.3, qemu-img-2:0.12.1.2-2.448.el6_6.3, qemu-kvm-2:0.12.1.2-2.448.el6_6.3 +1
- Red Hat Enterprise Linux Workstation (v. 6) qemu-guest-agent-2:0.12.1.2-2.448.el6_6.3, qemu-img-2:0.12.1.2-2.448.el6_6.3, qemu-kvm-2:0.12.1.2-2.448.el6_6.3 +1
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix yet |
| RHEL 7-based RHEV-H | Fixed | RHSA-2015:1011 |
| RHEV Agents (vdsm) | Fixed | RHSA-2015:1001 |
| RHEV Hypervisor for RHEL-6 | Fixed | RHSA-2015:1011 |
| RHEV-H and VDSM for 7 Hosts | Fixed | RHSA-2015:1000 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2015:1002 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2015:0999 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2015:0999 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2015:0999 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2015:1002 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2015:0998 |
| Red Hat Enterprise Linux Desktop Multi OS (v. 5 client) | Fixed | RHSA-2015:1002, RHSA-2015:1003 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2015:0998 |
| Red Hat Enterprise Linux HPC Node EUS (v. 6.5) | Fixed | RHSA-2015:1031 |
| Red Hat Enterprise Linux OpenStack Platform 4.0 | Fixed | RHSA-2015:1004 |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 | Fixed | RHSA-2015:1004 |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 | Fixed | RHSA-2015:1004 |
| Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 | Fixed | RHSA-2015:1004 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2015:0998 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2015:0999 |
| Red Hat Enterprise Linux Server EUS (v. 6.5) | Fixed | RHSA-2015:1031 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2015:0999 |
| Red Hat Enterprise Linux Virtualization (v. 5 server) | Fixed | RHSA-2015:1002, RHSA-2015:1003 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2015:0998 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2015:0999 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2015:0999 |
Timeline
- 2026-10-02 Threatist record created from CVE-2015-3456
- 2026-10-03 Alias added: GHSA-f822-h734-j822
References
Exploit 1
Advisory 27
- SUSE-SU-2015:0889
- DSA-3259
- SUSE-SU-2015:0929
- SUSE-SU-2015:0896
- GLSA-201612-27
- RHSA-2015:0999
- SUSE-SU-2015:0923
- RHSA-2015:1001
- HPSBMU03336
- RHSA-2015:1003
- openSUSE-SU-2015:0893
- HPSBMU03349
- RHSA-2015:0998
- openSUSE-SU-2015:0894
- FEDORA-2015-8249
- RHSA-2015:1004
- RHSA-2015:1011
- SUSE-SU-2015:0927
- GLSA-201604-03
- RHSA-2015:1002
- USN-2608-1
- openSUSE-SU-2015:0983
- DSA-3262
- GLSA-201602-01
- openSUSE-SU-2015:1400
- DSA-3274
- RHSA-2015:1000
Other 16
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- https://kb.juniper.net/JSA10783
- https://kc.mcafee.com/corporate/index?page=content&id=SB10118
- http://support.citrix.com/article/CTX201078
- http://xenbits.xen.org/xsa/advisory-133.html
- https://www.suse.com/security/cve/CVE-2015-3456.html
- https://bto.bluecoat.com/security-advisory/sa95
- http://venom.crowdstrike.com/
- https://support.lenovo.com/us/en/product_security/venom
- http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c
- https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10693
- http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm
- http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability
- https://access.redhat.com/articles/1444903
- https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10
Sources
- CVE-2015-3456 · CVE Program
- CVE-2015-3456 · NVD
- FIRST EPSS
- GHSA-f822-h734-j822 · GitHub Advisory Database · CC BY 4.0
- CVE-2015-3456 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences