> Both the traditional "qemu-xen" or upstream qemu device models are potentially vulnerable. VENOM was particularly nasty because, due to a bug/oversight, flop

> Both the traditional "qemu-xen" or upstream qemu device models are potentially vulnerable. VENOM was particularly nasty because, due to a bug/oversight, floppy emulation was always enabled in pretty much everything that used Qemu. This only affects one specific network driver, which to my knowledge, is nowhere used as default.