This script is Copyright (C) 2012 Tenable Network Security, Inc.
The remote Scientific Linux host is missing one or more security
KVM (Kernel-based Virtual Machine) is a full virtualization solution
for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module
built for the standard Red Hat Enterprise Linux kernel.
A flaw was found in the way QEMU handled VT100 terminal escape
sequences when emulating certain character devices. A guest user with
privileges to write to a character device that is emulated on the host
using a virtual console back-end could use this flaw to crash the
qemu-kvm process on the host or, possibly, escalate their privileges
on the host. (CVE-2012-3515)
This flaw did not affect the default use of KVM. Affected
configurations were :
- When guests were started from the command line
('/usr/libexec/qemu-kvm'), and without specifying a
serial or parallel device that specifically does not use
a virtual console (vc) back-end. (Note that Red Hat does
not support invoking 'qemu-kvm' from the command line on
Red Hat Enterprise Linux 5.)
- Guests that were managed via libvirt, such as when using
Virtual Machine Manager (virt-manager), but that have a
serial or parallel device that uses a virtual console
back-end. By default, guests managed via libvirt will
not use a virtual console back-end for such devices.
All KVM users should upgrade to these updated packages, which correct
See also :
Update the affected packages.
Risk factor :
High / CVSS Base Score : 7.2
Family: Scientific Linux Local Security Checks
Nessus Plugin ID: 61794 ()
CVE ID: CVE-2012-3515
The cookie settings on this website are set to 'allow all cookies' to give you the very best website experience. If you continue without changing these settings, you consent to this - but if you want, you can opt out of all cookies by clicking below.