Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

5/14/2015
04:40 PM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

Experts' Opinions Mixed On VENOM Vulnerability

Some say the virtualization vuln could be worse than Heartbleed, while others advise to patch, but don't panic.

While some security experts warn that the VENOM vulnerability disclosed yesterday is potentially worse than Heartbleed, others dismiss those comparisons and say the media coverage is overblown. Those who advise 'don't panic,' say VENOM is harder to exploit than Heartbleed, is more of a targeted attack tool than a weapon of mass destruction, and was already being contained before it had a chance to become a problem.

Virtualized Environment Neglected Operations Manipulation (VENOM) is a critical vulnerability in the open-source QEMU hypervisor -- and other hypervisors that use some of its code, like Xen and KVM -- that lets attackers break out of a virtual machine, execute code on a host machine and access all the other VMs on the host. Researchers at CrowdStrike announced their discovery of the vulnerability yesterday morning. Proof-of-concept code first surfaced yesterday afternoon. No exploits have yet appeared in the wild.

The company privately disclosed the bug to QEMU, and through them, to vendors with affected products. So by the time the announcement was made, some affected cloud service providers had already patched their systems; other affected product vendors released patches concurrent with the public disclosure. This is one reason some experts give for dialing down the VENOM hype.

"Is this the next Heartbleed? Unlikely," says Patrick Wardle, Director of Research at Synack. "Heartbleed affected a much wider range of servers and clients, and the responsibility to patch was often left up to the end user. With Venom, a single patch at the hypervisor level should secure all virtualized machines. In a cloud environment, the cloud provider is likely responsible for patching the bug (as opposed to the end users or ‘owners’ of the VM) — and has probably already done so."

Others point out that the ease and potential scale of the VENOM exploits differ from Heartbleed.

"The news of the VENOM vulnerability is concerning in breadth – similar to what we saw with Heartbleed in terms of the number of products affected. However, the severity of this zero-day is not nearly as alarming for a few reasons," says Veracode's VP of Research Chris Eng. "First, there is little chance of mass exploitation; any exploit created around VENOM would have to be tailored against a specific target environment. Second, the attacker would have to already be on the target system to get at the vulnerability – certainly not impossible in a public cloud environment but nevertheless a complicating factor. 

"While exploiting a vulnerability like Heartbleed allows an attacker to probe millions of systems, VENOM simply wouldn’t be exploitable at the same scale," says Eng. "Vulnerabilities like VENOM are mostly viewed as an avenue for a highly targeted attack like corporate espionage, cyber warfare or the like. Companies should absolutely apply patches as they become available."

“A virtual machine sandbox escape that allows you to attack other virtual machines is a sort of the brass ring for bug hunters. There have been previous bugs, but they typically required custom configurations and did not allow arbitrary code execution," says Cris Thomas, strategist at Tenable Network Security. "While CVE 2015-3456 (VENOM) does exist in the default configuration and does allow arbitrary code execution, it only impacts three of the six major vendors ... Though potentially serious if unpatched, this bug requires the attacker to get admin or root privileges in the root operating system and has not yet been seen in the wild. So while CVE 2015-3456 has been getting a lot of press, we have yet to see if its bite is as bad as the hype."

Still, some experts remain on high alert.

"This could turn into a massive problem - even larger than the Heartbleed bug - especially for highly popular cloud companies," says Carl Herberger, VP of Security Solutions at Radware. "Should this turn out to be as grave it could be, this may be the silver bullet many look for in disrupting or otherwise disabling organizations of all sorts. Moreover, it's not clear that this is an easy vulnerability to fix as it's not endemic to one hypervisor or one type of operation." 

"While this isn’t a vulnerability that would appear to affect the industry as broadly as some others, it is a virtual machine escape vulnerability in the default configuration," says Christopher Budd, Trend Micro’s global threat communications manager. "This is the worst possible vulnerability for virtual machine environments."

"This is a high-profile bug that can attack many systems at once, even if individually they are fully patched," says Qualys CTO Wolfgang Kandek. "Even worse, most people will not be able to scan for it, as their vendor (Amazon, Rackspace, etc.) is running the hypervisor for them, and as a customer, one does not have access."

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
PZav
50%
50%
PZav,
User Rank: Author
5/15/2015 | 11:05:42 AM
Why Should It Be Different This Time?
This vulnerability is incredibly serious in my opinion. I spent almost 5 years working for a Xen shop, cloud hosting provider. It's largely taken for granted that no one can escape the VM. However, in these massive server farms, its incredibly difficult to find malicous behavior if this were to be exploited. 

Obviously to the best of our knowledge this was discovered before this vuln got into the hands of the advesary. My concern is that in general we do not do well with 1. patching our systems and 2. limiting access. 

I think the popular thought out there is that anyone running Xen or KVM will somehow avoid the same mistakes we all continue to make. Perhaps that is the case. Everyone seems to be focusing on the fact that technologically this is an easy fix. However, we often forget that the scale of modern infrastructures makes emergency patches a logisitcal nightmare. Plus, its not just cloud hosting providers running Xen and KVM out there.
DavidH031
50%
50%
DavidH031,
User Rank: Apprentice
5/15/2015 | 11:24:37 AM
HyperV and/or VMware affected?
Can anyone readily address the question of whether or not this affects VMware or HyperV?
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19040
PUBLISHED: 2019-11-17
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
CVE-2019-19041
PUBLISHED: 2019-11-17
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by th...
CVE-2019-19012
PUBLISHED: 2019-11-17
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or ...
CVE-2019-19022
PUBLISHED: 2019-11-17
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git r...
CVE-2019-19035
PUBLISHED: 2019-11-17
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file.