Saint VENOM, Poison in the Virtual Floppy

Patron of virtual machines, floppy drives nobody uses any more, and lines of code forgotten since 2004.

Life

On 13 May 2015 Jason Geffner of CrowdStrike revealed VENOM (CVE-2015-3456): a buffer overflow in QEMU's floppy controller emulation, used by KVM and Xen. From a virtual machine one could crash the host or, perhaps, run code on it, escaping one's own cage toward the neighbouring VMs. The twist is that the virtual floppy was vulnerable even when no floppy was attached, and the code had been there since 2004.

Prayer

O Saint VENOM, who escapes the cage by way of a floppy drive, let our virtual machines each stay in their own home. Amen.

How to celebrate

Celebrated by updating QEMU and smiling at the idea of a 2015 attack that goes through the floppy.

Even the floppy that isn't there can bite you.