Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/14/2015
04:40 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Experts' Opinions Mixed On VENOM Vulnerability

Some say the virtualization vuln could be worse than Heartbleed, while others advise to patch, but don't panic.

While some security experts warn that the VENOM vulnerability disclosed yesterday is potentially worse than Heartbleed, others dismiss those comparisons and say the media coverage is overblown. Those who advise 'don't panic,' say VENOM is harder to exploit than Heartbleed, is more of a targeted attack tool than a weapon of mass destruction, and was already being contained before it had a chance to become a problem.

Virtualized Environment Neglected Operations Manipulation (VENOM) is a critical vulnerability in the open-source QEMU hypervisor -- and other hypervisors that use some of its code, like Xen and KVM -- that lets attackers break out of a virtual machine, execute code on a host machine and access all the other VMs on the host. Researchers at CrowdStrike announced their discovery of the vulnerability yesterday morning. Proof-of-concept code first surfaced yesterday afternoon. No exploits have yet appeared in the wild.

The company privately disclosed the bug to QEMU, and through them, to vendors with affected products. So by the time the announcement was made, some affected cloud service providers had already patched their systems; other affected product vendors released patches concurrent with the public disclosure. This is one reason some experts give for dialing down the VENOM hype.

"Is this the next Heartbleed? Unlikely," says Patrick Wardle, Director of Research at Synack. "Heartbleed affected a much wider range of servers and clients, and the responsibility to patch was often left up to the end user. With Venom, a single patch at the hypervisor level should secure all virtualized machines. In a cloud environment, the cloud provider is likely responsible for patching the bug (as opposed to the end users or ‘owners’ of the VM) — and has probably already done so."

Others point out that the ease and potential scale of the VENOM exploits differ from Heartbleed.

"The news of the VENOM vulnerability is concerning in breadth – similar to what we saw with Heartbleed in terms of the number of products affected. However, the severity of this zero-day is not nearly as alarming for a few reasons," says Veracode's VP of Research Chris Eng. "First, there is little chance of mass exploitation; any exploit created around VENOM would have to be tailored against a specific target environment. Second, the attacker would have to already be on the target system to get at the vulnerability – certainly not impossible in a public cloud environment but nevertheless a complicating factor. 

"While exploiting a vulnerability like Heartbleed allows an attacker to probe millions of systems, VENOM simply wouldn’t be exploitable at the same scale," says Eng. "Vulnerabilities like VENOM are mostly viewed as an avenue for a highly targeted attack like corporate espionage, cyber warfare or the like. Companies should absolutely apply patches as they become available."

“A virtual machine sandbox escape that allows you to attack other virtual machines is a sort of the brass ring for bug hunters. There have been previous bugs, but they typically required custom configurations and did not allow arbitrary code execution," says Cris Thomas, strategist at Tenable Network Security. "While CVE 2015-3456 (VENOM) does exist in the default configuration and does allow arbitrary code execution, it only impacts three of the six major vendors ... Though potentially serious if unpatched, this bug requires the attacker to get admin or root privileges in the root operating system and has not yet been seen in the wild. So while CVE 2015-3456 has been getting a lot of press, we have yet to see if its bite is as bad as the hype."

Still, some experts remain on high alert.

"This could turn into a massive problem - even larger than the Heartbleed bug - especially for highly popular cloud companies," says Carl Herberger, VP of Security Solutions at Radware. "Should this turn out to be as grave it could be, this may be the silver bullet many look for in disrupting or otherwise disabling organizations of all sorts. Moreover, it's not clear that this is an easy vulnerability to fix as it's not endemic to one hypervisor or one type of operation." 

"While this isn’t a vulnerability that would appear to affect the industry as broadly as some others, it is a virtual machine escape vulnerability in the default configuration," says Christopher Budd, Trend Micro’s global threat communications manager. "This is the worst possible vulnerability for virtual machine environments."

"This is a high-profile bug that can attack many systems at once, even if individually they are fully patched," says Qualys CTO Wolfgang Kandek. "Even worse, most people will not be able to scan for it, as their vendor (Amazon, Rackspace, etc.) is running the hypervisor for them, and as a customer, one does not have access."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DavidH031
50%
50%
DavidH031,
User Rank: Apprentice
5/15/2015 | 11:24:37 AM
HyperV and/or VMware affected?
Can anyone readily address the question of whether or not this affects VMware or HyperV?
PZav
50%
50%
PZav,
User Rank: Author
5/15/2015 | 11:05:42 AM
Why Should It Be Different This Time?
This vulnerability is incredibly serious in my opinion. I spent almost 5 years working for a Xen shop, cloud hosting provider. It's largely taken for granted that no one can escape the VM. However, in these massive server farms, its incredibly difficult to find malicous behavior if this were to be exploited. 

Obviously to the best of our knowledge this was discovered before this vuln got into the hands of the advesary. My concern is that in general we do not do well with 1. patching our systems and 2. limiting access. 

I think the popular thought out there is that anyone running Xen or KVM will somehow avoid the same mistakes we all continue to make. Perhaps that is the case. Everyone seems to be focusing on the fact that technologically this is an easy fix. However, we often forget that the scale of modern infrastructures makes emergency patches a logisitcal nightmare. Plus, its not just cloud hosting providers running Xen and KVM out there.
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Google's new See No Evil policy......
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31664
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 44741ff99f7a71df45420635b238b9c22093647a contains a buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-33185
PUBLISHED: 2021-06-18
SerenityOS contains a buffer overflow in the set_range test in TestBitmap which could allow attackers to obtain sensitive information.
CVE-2021-33186
PUBLISHED: 2021-06-18
SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information.
CVE-2021-31272
PUBLISHED: 2021-06-18
SerenityOS before commit 3844e8569689dd476064a0759d704bc64fb3ca2c contains a directory traversal vulnerability in tar/unzip that may lead to command execution or privilege escalation.
CVE-2021-31660
PUBLISHED: 2021-06-18
RIOT-OS 2021.01 before commit 85da504d2dc30188b89f44c3276fc5a25b31251f contains a buffer overflow which could allow attackers to obtain sensitive information.