VulnSocial

CVE-2015-3456Patch(qemu / enterprise_linux)

LOWCVSS 7.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch qemu enterprise_linux systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.

qemu CVEsBack to dashboard
1.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-119

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • enterprise_linux
  • enterprise_virtualization
  • openstack
  • qemu

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • False Positive: 1 classified signal
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-03-28); latest day: 1
  • 3 total mentions across 3 days

Affected systems

Vendors
qemuredhatxen
Products
enterprise_linuxenterprise_virtualizationopenstackqemuxen

7 versions affected across 5 products

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-03-28: 1Mentions · 2026-05-16: 1Mentions · 2026-08-07: 1Patch / Workaround · 2026-03-28: 103-2805-1608-07
Signal classification3 categories
Patch
133.3%
False Positive
133.3%
General
133.3%
Classification over time
DateTotalLabels
2026-03-281
Patch1
2026-05-161
False Positive1
2026-08-071
General1
Full discourse3 posts
  • ntddk@ntddk
    False Positive

    往年のVENOM（CVE-2015-3456）ほど影響範囲は広くはなく、仮想CXLデバイスを有効にしていないと刺さらない。だから「脆弱性じゃない」。

    Post summary

    The excerpt denies that the reported issue is a vulnerability, noting limited impact and lack of effect unless virtual CXL devices are enabled.

    2913615.6K
    7.5K followersView on X
  • أبو العماد السعدي@muayyadalsadi
    General

    @buhaimedi هذا النظام نجح في احتواء الثغرة VENOM CVE-2015-3456 التي اجتاحت كل مزودي خدمات الكلاود https://t.co/EWumDqjE7n

    Post summary

    The tweet notes that a system succeeded in containing the VENOM vulnerability (CVE-2015-3456) across cloud providers, providing only a link for further details.

    0003149
    1.6K followersView on X
  • أبو العماد السعدي@muayyadalsadi
    Patch

    نظام AppArmor يعرف سياسة وصول تعتمد على المسارات لذا يمكن التحايل عليها ببساطة بتغير المسار. بالمقابل SELinux يعتمد على ملصقات Labels لأي نوع من الموارد. الملصقات تظل مع المورد حتى لو تغير مساره. لذا استطاع حمايتنا من ثغرة Venom CVE-2015-3456

    Post summary

    The post notes that SELinux’s label‑based access control mitigated the Venom CVE‑2015‑3456 vulnerability, highlighting a practical workaround rather than a new exploit or patch.

    0001144
    1.5K followersView on X
CPE platform detail10 entries

10 of 10 entries

PartVendorProductVersionTarget SWTarget HW
Appqemuqemu---
OSredhatenterprise_linux5--
OSredhatenterprise_linux6.0--
OSredhatenterprise_linux7.0--
Appredhatenterprise_virtualization3.0--
Appredhatopenstack4.0--
Appredhatopenstack5.0--
Appredhatopenstack6.0--
Appredhatopenstack7.0--
OSxenxen4.5.0--

Explore more

Back to dashboardqemu CVEsredhat CVEsxen CVEsenterprise_linux vulnerabilities