VENOM vulnerability

VENOM refers to a security vulnerability that results from a buffer overflow in a kernel-level driver included in many default virtualized environments. The VENOM vulnerability has the potential to provide attackers with access to the host operating system and, as a result, other guest operating systems on the same host.

VENOM is of particular concern to enterprises, as it can compromise corporate data centers and cloud services, which tend to rely heavily on virtualized systems throughout their operations.

VENOM Specifics and Efforts to Patch Vulnerability

Security firm CrowdStrike discovered and named the VENOM vulnerability in early 2015. VENOM, an acronym for Virtualized Environment Neglected Operations Manipulation, arises from QEMU’s virtual Floppy Disk Controller (FDC), which carries a vulnerability that could enable an attacker to run code by pairing one of two flawed commands related to the controller with a buffer overflow.

The VENOM vulnerability affects KVM, Xen and native QEMU virtual machines. Virtual machines running on Microsoft Hyper-V or VMware hypervisors are not affected by VENOM. The VENOM vulnerability works with the default configuration of the affected virtualization platforms, so even when the FDC drive has not been added to the platform, systems are still vulnerable.

Fortunately, there is no evidence that VENOM has been exploited in the wild at this time, and many software firms have released updates recently for their products that patch the VENOM vulnerability, including Red Hat, Rackspace, SUSE and Citrix.

Forrest Stroud
Forrest Stroud
Forrest is a writer for Webopedia. Experienced, entrepreneurial, and well-rounded, he has 15+ years covering technology, business software, website design, programming, and more.

Related Articles

Human Resources Management System

A Human Resources Management System (HRMS) is a software application that supports many functions of a company's Human Resources department, including benefits administration, payroll,...

How To Defend Yourself Against Identity Theft

Almost every worldwide government agency responsible for identity theft issues will tell you the same thing: The first step to fighting identity theft is...

Infographic

An infographic is a visual representation of information or data. It combines the words information and graphic and includes a collection of imagery, charts,...

Phishing

What is phishing? Phishing is a type of cybercrime in which victims are contacted by email, telephone, or text message by an attacker posing as...

ScalaHosting

ScalaHosting is a leading managed hosting provider that offers secure, scalable, and affordable...

HRIS

Human resources information system (HRIS) solutions help businesses manage multiple facets of their...

Best Managed Service Providers...

In today's business world, managed services are more critical than ever. They can...