Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update
Affects Red Hat qemu-kvm-rhevSource GCVE Database
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 14 Nov 2026, 17:45 UTC
What to do
AI-suggested
Red Hat has released an update to qemu-kvm-rhev that includes the mitigation for CVE-2017-5715 and fixes the VFIO device unplugging issue. Users should apply this update to protect against the speculative execution attack and ensure correct device hot-unplug behavior. No additional action is required beyond applying the official update.
Description
This advisory addresses a security issue in the qemu-kvm-rhev packages used for KVM virtualization on Red Hat systems. It mitigates CVE-2017-5715, a speculative execution vulnerability known as branch target injection, which could allow an unprivileged attacker to read privileged memory across syscall and guest/host boundaries via cache side-channel attacks. Additionally, a bug fix corrects hot-unplugging of VFIO devices after unplugging vhost network devices. The update is part of Red Hat's security response to this industry-wide CPU vulnerability.
References
- access.redhat.com/errata/RHSA-2018:0055 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- access.redhat.com/security/vulnerabilities/speculativeexecution (opens in a new tab)
- access.redhat.com/solutions/3307851 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2017-5715 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=1498145 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=1519780 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=1525507 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0055.json (opens in a new tab)