The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:1431 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on a variety of     architectures. The qemu-kvm-rhev packages provide the user-space component for running virtual machines     that use KVM in environments managed by Red Hat products.

    Security Fix(es):

    * An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The     vulnerability could occur while copying VGA data using bitblt functions (for example,     cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU     process, resulting in denial of service. (CVE-2017-7718)

    Red Hat would like to thank Jiangxin (PSIRT Huawei Inc.) for reporting     CVE-2017-7718.

    Bug Fix(es):

    * When using post-copy migration with the virtio Random Number Generator (RNG) device, virtio-rng     continued generating data while the migration was already in post-copy mode. Consequently, the migration     sometimes failed and the error message Failed to load virtio-rng:virtio was displayed. The source code     has been improved and the problem no longer occurs in the scenario described. (BZ#1450375)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : qemu-kvm-rhev (RHSA-2017:1431)

medium Nessus Plugin ID 100833

Version 3.12