Description
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:2.3+dfsg-3 | — |
| Debian 14 | xen | 4.4.0-1 | — |
| Debian 13 | qemu | 1:2.3+dfsg-3 | — |
| Debian 13 | xen | 4.4.0-1 | — |
| Debian 12 | qemu | 1:2.3+dfsg-3 | — |
| Debian 12 | xen | 4.4.0-1 | — |
| Debian 8 | qemu | 1:2.1+dfsg-12 | DSA-3259-1 |
| Debian 8 | virtualbox | 4.3.18-dfsg-3+deb8u2 | DSA-3274-1 |
| Debian 7 | virtualbox | 4.1.18-dfsg-2+deb7u5 | DSA-3274-1 |
| Debian 7 | xen | 4.1.4-3+deb7u6 | DSA-3262-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | qemu | 2.0.0+dfsg-2ubuntu1.11 | USN-2608-1 |
| Ubuntu 14.04 LTS | virtualbox | 4.3.10-dfsg-1ubuntu5 | — |
| Ubuntu 14.04 LTS | xen | 4.4.1-0ubuntu0.14.04.6 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | qemu-img +6 | 10:1.5.3-86.el7_1.2 | RHSA-2015:0999 |
| RHEL 7 | qemu-img-rhev +6 | 10:2.1.2-23.el7_1.3 | RHSA-2015:1000 |
| RHEL 7 | rhev-hypervisor7 | 7.1-20150512.1.el7ev | RHSA-2015:1011 |
| RHEL 6 | qemu-img +6 | 2:0.12.1.2-2.448.el6_6.3 | RHSA-2015:1001, RHSA-2015:0998 |
| RHEL 6 | rhev-hypervisor6 | 6.6-20150512.0.el6ev | RHSA-2015:1011 |
| RHEL 5 | xen +1 | 3.0.3-146.el5_11 | RHSA-2015:1002 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Virtualization 5 | kvm +4 | 83-272.el5_11 | RHSA-2015:1003 |
| Red Hat Rhel Virtualization 5 | xen +1 | 3.0.3-146.el5_11 | RHSA-2015:1002 |
| RHEL 6.5 EUS | qemu-img +3 | 2:0.12.1.2-2.415.el6_5.15 | RHSA-2015:1031 |
| Red Hat OpenStack 6 | qemu-img-rhev +6 | 10:2.1.2-23.el7_1.3 | RHSA-2015:1004 |
| Red Hat OpenStack 5 | libcacard-rhev +4 | 10:2.1.2-23.el7_1.3 | RHSA-2015:1004 |
| Red Hat OpenStack 5 | qemu-img-rhev +2 | 2:0.12.1.2-2.448.el6_6.3 | RHSA-2015:1004 |
| Red Hat OpenStack 4 | qemu-img-rhev +2 | 2:0.12.1.2-2.448.el6_6.3 | RHSA-2015:1004 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | qemu | 2.0.2-46.1 | SUSE-SU-2015:0896-1 |
| SLES 12 | xen | 4.4.2_04-18.1 | SUSE-SU-2015:0923-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | qemu | 2.0.2-46.1 | SUSE-SU-2015:0896-1 |
| SLES for SAP 12 | xen | 4.4.2_04-18.1 | SUSE-SU-2015:0923-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu | 2.6.1-1.5 | openSUSE-SU-2024:10233-1 |
| openSUSE Tumbleweed | virtualbox | 5.1.10-2.5 | openSUSE-SU-2024:10020-1 |
| openSUSE Tumbleweed | xen | 4.7.0_12-1.3 | openSUSE-SU-2024:10196-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | qemu-img +6 | 10:1.5.3-86.el7_1.2 | ELSA-2015-0999 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- QEMU - Floppy Disk Controller (FDC) (PoC) EDB-37053 · dos · May 18, 2015
GitHub 2 repositories
-
vincentbernat/cve-2015-3456 ★ 14 · May 17, 2015
Experiments related to CVE-2015-3456
-
orf53975/poisonfrog ★ 0 · Dec 3, 2018
A VENOM (CVE-2015-3456) Exploit / PoC written in C.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 22
- RHSA-2015:1031 Red Hat Security Advisory: qemu-kvm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1011 Red Hat Security Advisory: rhev-hypervisor security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1003 Red Hat Security Advisory: kvm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1004 Red Hat Security Advisory: qemu-kvm-rhev security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1001 Red Hat Security Advisory: qemu-kvm-rhev security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1002 Red Hat Security Advisory: xen security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:0999 Red Hat Security Advisory: qemu-kvm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:1000 Red Hat Security Advisory: qemu-kvm-rhev security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:0998 Red Hat Security Advisory: qemu-kvm security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-3274-1 virtualbox - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-268-1 virtualbox-ose - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-249-1 qemu-kvm - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3259-1 qemu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3262-1 xen - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-248-1 qemu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2608-1 qemu, qemu-kvm vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2015:0923-1 Security update for xen SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10233-1 qemu-2.6.1-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:0896-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10020-1 python-virtualbox-5.1.10-2.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10196-1 xen-4.7.0_12-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ELSA-2015-0999 Important: qemu-kvm security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · May 13, 2015
References
- 37053 exploit
- 1032306 vdb-entry
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- SUSE-SU-2015:0889 vendor-advisory
- https://kb.juniper.net/JSA10783
- DSA-3259 vendor-advisory
- SUSE-SU-2015:0929 vendor-advisory
- SUSE-SU-2015:0896 vendor-advisory
- GLSA-201612-27 vendor-advisory
- RHSA-2015:0999 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10118
- SUSE-SU-2015:0923 vendor-advisory
- RHSA-2015:1001 vendor-advisory
- HPSBMU03336 vendor-advisory
- http://support.citrix.com/article/CTX201078
- http://xenbits.xen.org/xsa/advisory-133.html
- RHSA-2015:1003 vendor-advisory
- openSUSE-SU-2015:0893 vendor-advisory
- 1032917 vdb-entry
- HPSBMU03349 vendor-advisory
- RHSA-2015:0998 vendor-advisory
- https://www.suse.com/security/cve/CVE-2015-3456.html
- openSUSE-SU-2015:0894 vendor-advisory
- FEDORA-2015-8249 vendor-advisory
- https://bto.bluecoat.com/security-advisory/sa95
- RHSA-2015:1004 vendor-advisory
- http://venom.crowdstrike.com/
- RHSA-2015:1011 vendor-advisory
- https://support.lenovo.com/us/en/product_security/venom
- SUSE-SU-2015:0927 vendor-advisory
- http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=e907746266721f305d67bc0718795fedee2e824c
- GLSA-201604-03 vendor-advisory
- RHSA-2015:1002 vendor-advisory
- USN-2608-1 vendor-advisory
- https://securityblog.redhat.com/2015/05/13/venom-dont-get-bitten/
- openSUSE-SU-2015:0983 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10693
- 1032311 vdb-entry
- http://www1.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-438937.htm
- DSA-3262 vendor-advisory
- GLSA-201602-01 vendor-advisory
- openSUSE-SU-2015:1400 vendor-advisory
- 74640 vdb-entry
- DSA-3274 vendor-advisory
- http://www.fortiguard.com/advisory/2015-05-19-cve-2015-3456-venom-vulnerability
- https://access.redhat.com/articles/1444903
- RHSA-2015:1000 vendor-advisory
- https://www.arista.com/en/support/advisories-notices/security-advisories/1128-security-advisory-10