3 ms·
[...] security vulnerability in the virtual floppy drive code [...] For many of the affected virtualization products, a virtual floppy drive is added to new vir
by gvb 11y ago
[...] security vulnerability in the virtual floppy drive code [...] For many of the affected virtualization products, a virtual floppy drive is added to new virtual machines by default.
That is a pretty simple mitigation. Make sure there are no (unnecessary) virtual floppy devices defined in your VMs.
I checked my VMs (Ubuntu/KVM) and, as expected, none of them have a virtual floppy - they are not added by default on that platform.
- muppetman 11y agoYou didn't read much of the page :) To quote: "For many of the affected virtualization products, a virtual floppy drive is added to new virtual machines by default. And on Xen and QEMU, even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers."
- bonzini 11y agoThey don't have a virtual floppy drive, but they do have a virtual floppy drive _controller_.