Vulnerabilities / Threats

5/14/2015
04:40 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Experts' Opinions Mixed On VENOM Vulnerability

Some say the virtualization vuln could be worse than Heartbleed, while others advise to patch, but don't panic.

While some security experts warn that the VENOM vulnerability disclosed yesterday is potentially worse than Heartbleed, others dismiss those comparisons and say the media coverage is overblown. Those who advise 'don't panic,' say VENOM is harder to exploit than Heartbleed, is more of a targeted attack tool than a weapon of mass destruction, and was already being contained before it had a chance to become a problem.

Virtualized Environment Neglected Operations Manipulation (VENOM) is a critical vulnerability in the open-source QEMU hypervisor -- and other hypervisors that use some of its code, like Xen and KVM -- that lets attackers break out of a virtual machine, execute code on a host machine and access all the other VMs on the host. Researchers at CrowdStrike announced their discovery of the vulnerability yesterday morning. Proof-of-concept code first surfaced yesterday afternoon. No exploits have yet appeared in the wild.

The company privately disclosed the bug to QEMU, and through them, to vendors with affected products. So by the time the announcement was made, some affected cloud service providers had already patched their systems; other affected product vendors released patches concurrent with the public disclosure. This is one reason some experts give for dialing down the VENOM hype.

"Is this the next Heartbleed? Unlikely," says Patrick Wardle, Director of Research at Synack. "Heartbleed affected a much wider range of servers and clients, and the responsibility to patch was often left up to the end user. With Venom, a single patch at the hypervisor level should secure all virtualized machines. In a cloud environment, the cloud provider is likely responsible for patching the bug (as opposed to the end users or ‘owners’ of the VM) — and has probably already done so."

Others point out that the ease and potential scale of the VENOM exploits differ from Heartbleed.

"The news of the VENOM vulnerability is concerning in breadth – similar to what we saw with Heartbleed in terms of the number of products affected. However, the severity of this zero-day is not nearly as alarming for a few reasons," says Veracode's VP of Research Chris Eng. "First, there is little chance of mass exploitation; any exploit created around VENOM would have to be tailored against a specific target environment. Second, the attacker would have to already be on the target system to get at the vulnerability – certainly not impossible in a public cloud environment but nevertheless a complicating factor. 

"While exploiting a vulnerability like Heartbleed allows an attacker to probe millions of systems, VENOM simply wouldn’t be exploitable at the same scale," says Eng. "Vulnerabilities like VENOM are mostly viewed as an avenue for a highly targeted attack like corporate espionage, cyber warfare or the like. Companies should absolutely apply patches as they become available."

“A virtual machine sandbox escape that allows you to attack other virtual machines is a sort of the brass ring for bug hunters. There have been previous bugs, but they typically required custom configurations and did not allow arbitrary code execution," says Cris Thomas, strategist at Tenable Network Security. "While CVE 2015-3456 (VENOM) does exist in the default configuration and does allow arbitrary code execution, it only impacts three of the six major vendors ... Though potentially serious if unpatched, this bug requires the attacker to get admin or root privileges in the root operating system and has not yet been seen in the wild. So while CVE 2015-3456 has been getting a lot of press, we have yet to see if its bite is as bad as the hype."

Still, some experts remain on high alert.

"This could turn into a massive problem - even larger than the Heartbleed bug - especially for highly popular cloud companies," says Carl Herberger, VP of Security Solutions at Radware. "Should this turn out to be as grave it could be, this may be the silver bullet many look for in disrupting or otherwise disabling organizations of all sorts. Moreover, it's not clear that this is an easy vulnerability to fix as it's not endemic to one hypervisor or one type of operation." 

"While this isn’t a vulnerability that would appear to affect the industry as broadly as some others, it is a virtual machine escape vulnerability in the default configuration," says Christopher Budd, Trend Micro’s global threat communications manager. "This is the worst possible vulnerability for virtual machine environments."

"This is a high-profile bug that can attack many systems at once, even if individually they are fully patched," says Qualys CTO Wolfgang Kandek. "Even worse, most people will not be able to scan for it, as their vendor (Amazon, Rackspace, etc.) is running the hypervisor for them, and as a customer, one does not have access."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DavidH031
50%
50%
DavidH031,
User Rank: Apprentice
5/15/2015 | 11:24:37 AM
HyperV and/or VMware affected?
Can anyone readily address the question of whether or not this affects VMware or HyperV?
PZav
50%
50%
PZav,
User Rank: Author
5/15/2015 | 11:05:42 AM
Why Should It Be Different This Time?
This vulnerability is incredibly serious in my opinion. I spent almost 5 years working for a Xen shop, cloud hosting provider. It's largely taken for granted that no one can escape the VM. However, in these massive server farms, its incredibly difficult to find malicous behavior if this were to be exploited. 

Obviously to the best of our knowledge this was discovered before this vuln got into the hands of the advesary. My concern is that in general we do not do well with 1. patching our systems and 2. limiting access. 

I think the popular thought out there is that anyone running Xen or KVM will somehow avoid the same mistakes we all continue to make. Perhaps that is the case. Everyone seems to be focusing on the fact that technologically this is an easy fix. However, we often forget that the scale of modern infrastructures makes emergency patches a logisitcal nightmare. Plus, its not just cloud hosting providers running Xen and KVM out there.
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Secure Wifi Hijacked by KRACK Vulns in WPA2
Jai Vijayan, Freelance writer,  10/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.