VIR Vulnerability Intelligence Relay

CVE-2015-3456

high
Published 2015-05-13 · Modified 2026-05-06
CVSS v3
—
CVSS v2
7.7
VIR risk
7.7

Description

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2015-3456

OS impact
OSVersionStatusFixed in
redhat rhel5affected
redhat rhel6.0affected
redhat rhel7.0affected
debian debianbookwormfixed1:2.3+dfsg-3
debian debianbullseyefixed1:2.3+dfsg-3
debian debianforkyfixed1:2.3+dfsg-3
debian debiansidfixed1:2.3+dfsg-3
debian debiantrixiefixed1:2.3+dfsg-3

Application impact
VendorProductVersionsFixed
qemuqemu{"endIncluding":"2.3.0"}
redhat redhatenterprise_virtualization3.0
redhat redhatopenstack4.0
redhat redhatopenstack5.0
redhat redhatopenstack6.0
redhat redhatopenstack7.0

References

CWEs

CWE-119

Verify integrity in audit chain (admin only). AS-IS.