Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update
Affects Red Hat qemu-kvm-rhevSource GCVE Database
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 14 Nov 2026, 17:45 UTC
What to do
AI-suggested
A security and bug fix update for qemu-kvm-rhev packages is available from Red Hat that addresses CVE-2017-5715 and the VFIO device hot-unplug issue. Users should apply this update to mitigate the speculative execution side-channel vulnerability and to ensure correct device unplug behavior. No indication is given that no action is required or that the issue is already mitigated without patching.
Description
This advisory addresses a security vulnerability in the qemu-kvm-rhev packages used by Red Hat for KVM virtualization. The vulnerability relates to the speculative execution side-channel attack known as CVE-2017-5715 (branch target injection), which can allow an unprivileged attacker to read privileged memory across syscall and guest/host boundaries. The update also fixes a bug related to hot-unplugging VFIO devices after unplugging a vhost network device.
References
- access.redhat.com/errata/RHSA-2018:0054 (opens in a new tab)
- access.redhat.com/security/updates/classification/ (opens in a new tab)
- access.redhat.com/security/vulnerabilities/speculativeexecution (opens in a new tab)
- access.redhat.com/solutions/3307851 (opens in a new tab)
- access.redhat.com/security/cve/CVE-2017-5715 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=1498146 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=1519780 (opens in a new tab)
- bugzilla.redhat.com/show_bug.cgi?id=1525510 (opens in a new tab)
- security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0054.json (opens in a new tab)