Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/14/2015
04:40 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Experts' Opinions Mixed On VENOM Vulnerability

Some say the virtualization vuln could be worse than Heartbleed, while others advise to patch, but don't panic.

While some security experts warn that the VENOM vulnerability disclosed yesterday is potentially worse than Heartbleed, others dismiss those comparisons and say the media coverage is overblown. Those who advise 'don't panic,' say VENOM is harder to exploit than Heartbleed, is more of a targeted attack tool than a weapon of mass destruction, and was already being contained before it had a chance to become a problem.

Virtualized Environment Neglected Operations Manipulation (VENOM) is a critical vulnerability in the open-source QEMU hypervisor -- and other hypervisors that use some of its code, like Xen and KVM -- that lets attackers break out of a virtual machine, execute code on a host machine and access all the other VMs on the host. Researchers at CrowdStrike announced their discovery of the vulnerability yesterday morning. Proof-of-concept code first surfaced yesterday afternoon. No exploits have yet appeared in the wild.

The company privately disclosed the bug to QEMU, and through them, to vendors with affected products. So by the time the announcement was made, some affected cloud service providers had already patched their systems; other affected product vendors released patches concurrent with the public disclosure. This is one reason some experts give for dialing down the VENOM hype.

"Is this the next Heartbleed? Unlikely," says Patrick Wardle, Director of Research at Synack. "Heartbleed affected a much wider range of servers and clients, and the responsibility to patch was often left up to the end user. With Venom, a single patch at the hypervisor level should secure all virtualized machines. In a cloud environment, the cloud provider is likely responsible for patching the bug (as opposed to the end users or ‘owners’ of the VM) — and has probably already done so."

Others point out that the ease and potential scale of the VENOM exploits differ from Heartbleed.

"The news of the VENOM vulnerability is concerning in breadth – similar to what we saw with Heartbleed in terms of the number of products affected. However, the severity of this zero-day is not nearly as alarming for a few reasons," says Veracode's VP of Research Chris Eng. "First, there is little chance of mass exploitation; any exploit created around VENOM would have to be tailored against a specific target environment. Second, the attacker would have to already be on the target system to get at the vulnerability – certainly not impossible in a public cloud environment but nevertheless a complicating factor. 

"While exploiting a vulnerability like Heartbleed allows an attacker to probe millions of systems, VENOM simply wouldn’t be exploitable at the same scale," says Eng. "Vulnerabilities like VENOM are mostly viewed as an avenue for a highly targeted attack like corporate espionage, cyber warfare or the like. Companies should absolutely apply patches as they become available."

“A virtual machine sandbox escape that allows you to attack other virtual machines is a sort of the brass ring for bug hunters. There have been previous bugs, but they typically required custom configurations and did not allow arbitrary code execution," says Cris Thomas, strategist at Tenable Network Security. "While CVE 2015-3456 (VENOM) does exist in the default configuration and does allow arbitrary code execution, it only impacts three of the six major vendors ... Though potentially serious if unpatched, this bug requires the attacker to get admin or root privileges in the root operating system and has not yet been seen in the wild. So while CVE 2015-3456 has been getting a lot of press, we have yet to see if its bite is as bad as the hype."

Still, some experts remain on high alert.

"This could turn into a massive problem - even larger than the Heartbleed bug - especially for highly popular cloud companies," says Carl Herberger, VP of Security Solutions at Radware. "Should this turn out to be as grave it could be, this may be the silver bullet many look for in disrupting or otherwise disabling organizations of all sorts. Moreover, it's not clear that this is an easy vulnerability to fix as it's not endemic to one hypervisor or one type of operation." 

"While this isn’t a vulnerability that would appear to affect the industry as broadly as some others, it is a virtual machine escape vulnerability in the default configuration," says Christopher Budd, Trend Micro’s global threat communications manager. "This is the worst possible vulnerability for virtual machine environments."

"This is a high-profile bug that can attack many systems at once, even if individually they are fully patched," says Qualys CTO Wolfgang Kandek. "Even worse, most people will not be able to scan for it, as their vendor (Amazon, Rackspace, etc.) is running the hypervisor for them, and as a customer, one does not have access."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DavidH031
50%
50%
DavidH031,
User Rank: Apprentice
5/15/2015 | 11:24:37 AM
HyperV and/or VMware affected?
Can anyone readily address the question of whether or not this affects VMware or HyperV?
PZav
50%
50%
PZav,
User Rank: Author
5/15/2015 | 11:05:42 AM
Why Should It Be Different This Time?
This vulnerability is incredibly serious in my opinion. I spent almost 5 years working for a Xen shop, cloud hosting provider. It's largely taken for granted that no one can escape the VM. However, in these massive server farms, its incredibly difficult to find malicous behavior if this were to be exploited. 

Obviously to the best of our knowledge this was discovered before this vuln got into the hands of the advesary. My concern is that in general we do not do well with 1. patching our systems and 2. limiting access. 

I think the popular thought out there is that anyone running Xen or KVM will somehow avoid the same mistakes we all continue to make. Perhaps that is the case. Everyone seems to be focusing on the fact that technologically this is an easy fix. However, we often forget that the scale of modern infrastructures makes emergency patches a logisitcal nightmare. Plus, its not just cloud hosting providers running Xen and KVM out there.
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27254
PUBLISHED: 2021-03-05
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the apply_save.cgi endpoint. This issue results from the use of hard-coded encrypti...
CVE-2021-27255
PUBLISHED: 2021-03-05
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this vulnerability. The specific flaw exists within the refresh_status.aspx endpoint. The issue results from a lack of...
CVE-2021-27256
PUBLISHED: 2021-03-05
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists wit...
CVE-2021-27257
PUBLISHED: 2021-03-05
This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via...
CVE-2021-26705
PUBLISHED: 2021-03-05
An issue was discovered in SquareBox CatDV Server through 9.2. An attacker can invoke sensitive RMI methods such as getConnections without authentication, the results of which can be used to generate valid authentication tokens. These tokens can then be used to invoke administrative tasks within the...