The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:0082 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for     Linux on AMD64 and Intel 64 systems. The qemu-kvm package provides the     user-space component for running virtual machines using KVM.

    An out-of-bounds read/write flaw was discovered in the way QEMU's Firmware     Configuration device emulation processed certain firmware configurations.
    A privileged (CAP_SYS_RAWIO) guest user could use this flaw to crash the     QEMU process instance or, potentially, execute arbitrary code on the host     with privileges of the QEMU process. (CVE-2016-1714)

    Red Hat would like to thank Donghai Zhu of Alibaba for reporting this     issue.

    All qemu-kvm users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue. After installing this     update, shut down all running virtual machines. Once all virtual machines     have shut down, start them again for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 6 : qemu-kvm (RHSA-2016:0082)

high Nessus Plugin ID 88481

Version 2.13