Experts' Opinions Mixed On VENOM Vulnerability

While some security experts warn that the VENOM vulnerability disclosed yesterday is potentially worse than Heartbleed, others dismiss those comparisons and say the media coverage is overblown. Those who advise 'don't panic,' say VENOM is harder to exploit than Heartbleed, is more of a targeted attack tool than a weapon of mass destruction, and was already being contained before it had a chance to become a problem.

Virtualized Environment Neglected Operations Manipulation (VENOM) is a critical vulnerability in the open-source QEMU hypervisor -- and other hypervisors that use some of its code, like Xen and KVM -- that lets attackers break out of a virtual machine, execute code on a host machine and access all the other VMs on the host. Researchers at CrowdStrike announced their discovery of the vulnerability yesterday morning. Proof-of-concept code first surfaced yesterday afternoon. No exploits have yet appeared in the wild.

The company privately disclosed the bug to QEMU, and through them, to vendors with affected products. So by the time the announcement was made, some affected cloud service providers had already patched their systems; other affected product vendors released patches concurrent with the public disclosure. This is one reason some experts give for dialing down the VENOM hype.

"Is this the next Heartbleed? Unlikely," says Patrick Wardle, Director of Research at Synack. "Heartbleed affected a much wider range of servers and clients, and the responsibility to patch was often left up to the end user. With Venom, a single patch at the hypervisor level should secure all virtualized machines. In a cloud environment, the cloud provider is likely responsible for patching the bug (as opposed to the end users or ‘owners’ of the VM) — and has probably already done so."

Others point out that the ease and potential scale of the VENOM exploits differ from Heartbleed.

"The news of the VENOM vulnerability is concerning in breadth – similar to what we saw with Heartbleed in terms of the number of products affected. However, the severity of this zero-day is not nearly as alarming for a few reasons," says Veracode's VP of Research Chris Eng. "First, there is little chance of mass exploitation; any exploit created around VENOM would have to be tailored against a specific target environment. Second, the attacker would have to already be on the target system to get at the vulnerability – certainly not impossible in a public cloud environment but nevertheless a complicating factor. 

"While exploiting a vulnerability like Heartbleed allows an attacker to probe millions of systems, VENOM simply wouldn’t be exploitable at the same scale," says Eng. "Vulnerabilities like VENOM are mostly viewed as an avenue for a highly targeted attack like corporate espionage, cyber warfare or the like. Companies should absolutely apply patches as they become available."

Read the rest of the article at Dark Reading.