The just-patched critical vulnerability in widely used virtualization software is an ideal exploitation target for state-sponsored spies and criminals alike fishing for passwords, cryptography keys, or bitcoins, a researcher who has dissected one of the fixes said.

The bug, which is known to affect the Xen, KVM, and native QEMU virtual machine platforms and appliances, makes it possible for attackers to break out of protected guest environments and take full control of the operating system hosting them, security researchers warned Wednesday. In the hours following Wednesday morning's disclosure of the vulnerability, many security professionals have publicly said its severity is being exaggerated. The critics have rightly pointed out that it can't be remotely exploited and can't be exploited on large numbers of machines in a single stroke, as is the case with most serious security bugs.

Rob Graham, CEO of security firm Errata Security, has indicated that the bug is still worth taking seriously. For one thing, he suspects it will be easy for attackers to exploit the flaw. For another, he said exploits could yield highly valuable assets on vulnerable machines, particularly on virtual private servers, which use virtualization to segregate different customers' data on the same physical machine. In a blog post published a few hours after the vulnerability came to light, Graham wrote:

The details look straightforward, which means a PoC should arrive by tomorrow. This is a hypervisor privilege escalation bug. To exploit this, you'd sign up with one of the zillions of VPS providers and get a Linux instance. You'd then, likely, replace the floppy driver in the Linux kernel with a custom driver that exploits this bug. You have root access to your own kernel, of course, which you are going to escalate to root access of the hypervisor. People suggest adding an exploit to toolkits like Metasploit framework—but I don't think it has a framework for running drivers. This would instead be more of a one-off. Once you gained control of the host, you'd then of course gain access to any of the other instances. This would be a perfect bug for the NSA. Bitcoin wallets, RSA private keys, forum passwords, and the like are easily found searching raw memory. Once you've popped the host, reading memory of other hosted virtual machines is undetectable. Assuming the NSA had a program that they'd debugged over the years that looked for such stuff, for $100,000 they could buy a ton of $10 VPS instances around the world, then run the search. All sorts of great information would fall out of such an effort—you'd probably make your money back from discovered Bitcoin alone.

The idea that the NSA would risk blowing its cover by cashing in stolen bitcoins aside, the scenario seems plausible. Critics may have good reason to criticize the overdone marketing of the vulnerability, which its finders have branded "Venom" and accompanied with a logo of a scary-looking Cobra. And there's even better reason to chafe at media reports comparing the severity of Venom to last year's catastrophic Heartbleed vulnerability. But that doesn't mean the 11-year-old Venom bug doesn't pose a threat, and it certainly doesn't mean VPS hosts shouldn't patch it soon.