Blog UpCloud and VENOM, CVE-2015-3456, Security Vulnerability

UpCloud and VENOM, CVE-2015-3456, Security Vulnerability

Yesterday, on Wednesday 13th, 2015, Crowdstrike announced information regarding a security vulnerability they had discovered in the floppy disk controller on QEMU. The vulnerability allows an attacker to escape the confinement of the Virtual Machine guest operating system and gain privileged access to the host machine.

Since a key component of security in virtualised environments is the ability to limit access to guest operating systems only, patching this vulnerability was of major importance immediately when we saw it.

Last night, at around 17.30 UTC, we informed all our customers via e-mail about the patching process that would begin later that night at 19.00 UTC. We did not want to publicly announce anything since this would have given notice to potential exploiters as well. This morning, at 6:28 UTC, all UpCloud’s host machines in all three service areas had been patched.

While this project was enormous given such a short time frame, with the forced security updates we were able to migrate all customers to updated host machines. We were able to decommission, in an accelerated fashion, a large number of older host machines resulting in better performance and reliability for our customers at large.

The CVE-2015-3456 advisory is not an issue on UpCloud anymore and we want to thank our customers for co-operating with us on such a short notice. We continue to monitor all announcements and advisories regarding the different components we use in our infrastructure to keep our service as secure as possible.

Leave a Reply

Your email address will not be published. Required fields are marked *

Locations

Helsinki (HQ)

In the capital city of Finland, you will find our headquarters, and our first data centre. This is where we handle most of our development and innovation.

London

London was our second office to open, and a important step in introducing UpCloud to the world. Here our amazing staff can help you with both sales and support, in addition to host tons of interesting meetups.

Seattle

Seattle is our 4th and latest office to be opened, and our way to reach out across the pond to our many users in the Americas.

Singapore

Singapore was our 3rd office to be opened, and enjoys one of most engaged and fastest growing user bases we have ever seen.