What does VENOM stand for in cybersecurity?
VENOM stands for Virtualized Environment Neglected Operations Manipulation. It is a computer security vulnerability registered as CVE-2015-3456, first publicly disclosed on the 13th of May 2015.
Questions about Venom
Short answers, pulled from the story.
Who discovered the VENOM vulnerability?
Jason Geffner, a senior security researcher at CrowdStrike, discovered VENOM during a security review of virtual machine hypervisors. CrowdStrike then coordinated disclosure with QEMU maintainers and affected vendors before the public announcement.
What systems were affected by the VENOM flaw?
VENOM affected QEMU, Xen, KVM, and VirtualBox. The vulnerability originated in QEMU's virtual floppy disk controller and spread to any platform or cloud infrastructure that embedded that code.
When was the VENOM vulnerability introduced and when was it patched?
The VENOM flaw was introduced in 2004 and remained undetected until it was publicly disclosed on the 13th of May 2015. Patches were issued by vendors including Red Hat, SUSE, Oracle, and IBM in the days following disclosure.
What part of QEMU contained the VENOM security flaw?
The VENOM vulnerability resided in QEMU's implementation of the virtual floppy disk controller (FDC). Because higher-level systems such as Xen and KVM reused this QEMU code, the defect spread across multiple virtualization platforms.
Which vendors issued patches for VENOM after it was disclosed?
Red Hat, SUSE, Oracle, and IBM all issued security advisories and updates in quick succession following the public disclosure on the 13th of May 2015. The Xen Project and Linux distribution providers were also involved in the coordinated response.