Comment by gvb - Hacker Neue

gvb May 13, 2015 parent

[...] security vulnerability in the virtual floppy drive code [...] For many of the affected virtualization products, a virtual floppy drive is added to new virtual machines by default.

That is a pretty simple mitigation. Make sure there are no (unnecessary) virtual floppy devices defined in your VMs.

I checked my VMs (Ubuntu/KVM) and, as expected, none of them have a virtual floppy - they are not added by default on that platform.

muppetman May 13, 2015

You didn't read much of the page :)

To quote:

"For many of the affected virtualization products, a virtual floppy drive is added to new virtual machines by default. And on Xen and QEMU, even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers."

bonzini May 13, 2015

They don't have a virtual floppy drive, but they do have a virtual floppy drive _controller_.

This item has no comments currently.