FKIE_CVE-2011-1751

Vulnerability from fkie_nvd - Published: 2012-06-21 15:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
References
secalert@redhat.comhttp://blog.nelhage.com/2011/08/breaking-out-of-kvm/
secalert@redhat.comhttp://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=505597e4476a6bc219d0ec1362b760d71cb4fdca
secalert@redhat.comhttp://lists.nongnu.org/archive/html/qemu-devel/2011-05/msg01810.html
secalert@redhat.comhttp://lists.opensuse.org/opensuse-updates/2011-05/msg00043.html
secalert@redhat.comhttp://rhn.redhat.com/errata/RHSA-2011-0534.html
secalert@redhat.comhttp://secunia.com/advisories/44393Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/44458Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/44648Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/44658Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/44660Vendor Advisory
secalert@redhat.comhttp://secunia.com/advisories/44900Vendor Advisory
secalert@redhat.comhttp://www.openwall.com/lists/oss-security/2011/05/19/2
secalert@redhat.comhttp://www.osvdb.org/73395
secalert@redhat.comhttp://www.securityfocus.com/bid/47927
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=699773
secalert@redhat.comhttps://github.com/nelhage/virtunoid
secalert@redhat.comhttps://hermes.opensuse.org/messages/8572547
secalert@redhat.comhttps://www.ubuntu.com/usn/USN-1145-1/
af854a3a-2127-422b-91ae-364da2661108http://blog.nelhage.com/2011/08/breaking-out-of-kvm/
af854a3a-2127-422b-91ae-364da2661108http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=505597e4476a6bc219d0ec1362b760d71cb4fdca
af854a3a-2127-422b-91ae-364da2661108http://lists.nongnu.org/archive/html/qemu-devel/2011-05/msg01810.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-updates/2011-05/msg00043.html
af854a3a-2127-422b-91ae-364da2661108http://rhn.redhat.com/errata/RHSA-2011-0534.html
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/44393Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/44458Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/44648Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/44658Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/44660Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/44900Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2011/05/19/2
af854a3a-2127-422b-91ae-364da2661108http://www.osvdb.org/73395
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/47927
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=699773
af854a3a-2127-422b-91ae-364da2661108https://github.com/nelhage/virtunoid
af854a3a-2127-422b-91ae-364da2661108https://hermes.opensuse.org/messages/8572547
af854a3a-2127-422b-91ae-364da2661108https://www.ubuntu.com/usn/USN-1145-1/
Impacted products
Vendor Product Version
qemu qemu 0.1.0
qemu qemu 0.1.1
qemu qemu 0.1.2
qemu qemu 0.1.3
qemu qemu 0.1.4
qemu qemu 0.1.5
qemu qemu 0.1.6
qemu qemu 0.2.0
qemu qemu 0.3.0
qemu qemu 0.4.0
qemu qemu 0.4.1
qemu qemu 0.4.2
qemu qemu 0.4.3
qemu qemu 0.5.0
qemu qemu 0.5.1
qemu qemu 0.5.2
qemu qemu 0.5.3
qemu qemu 0.5.4
qemu qemu 0.5.5
qemu qemu 0.6.0
qemu qemu 0.6.1
qemu qemu 0.7.0
qemu qemu 0.7.1
qemu qemu 0.7.2
qemu qemu 0.8.0
qemu qemu 0.8.1
qemu qemu 0.8.2
qemu qemu 0.9.0
qemu qemu 0.9.1
qemu qemu 0.9.1-5
qemu qemu 0.10.0
qemu qemu 0.10.1
qemu qemu 0.10.2
qemu qemu 0.10.3
qemu qemu 0.10.4
qemu qemu 0.10.5
qemu qemu 0.10.6
qemu qemu 0.11.0
qemu qemu 0.11.0
qemu qemu 0.11.0
qemu qemu 0.11.0
qemu qemu 0.11.0-rc0
qemu qemu 0.11.0-rc1
qemu qemu 0.11.0-rc2
qemu qemu 0.11.1
qemu qemu 0.12.0
qemu qemu 0.12.0
qemu qemu 0.12.0
qemu qemu 0.12.1
qemu qemu 0.12.2
qemu qemu 0.12.3
qemu qemu 0.12.4
qemu qemu 0.12.5
qemu qemu 0.13.0
qemu qemu 0.13.0
qemu qemu 0.13.0
qemu qemu 0.14.0
qemu qemu 0.14.0
qemu qemu 0.14.0
qemu qemu 0.14.0
qemu qemu 0.14.1
qemu qemu 0.15.0
qemu qemu 0.15.0
qemu qemu 1.0
qemu qemu 1.0
qemu qemu 1.0
qemu qemu 1.0
qemu qemu 1.0
qemu qemu 1.0.1
qemu qemu 1.1
qemu qemu 1.1
qemu qemu 1.1
qemu qemu 1.1
qemu qemu 1.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC82CD08-F151-489C-9BC4-50C8C9583718",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "75D04344-C6CE-40D5-97ED-42B3DBA1AAD7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "71CC4D45-66BE-4C23-B541-DD4604ACC9FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "2E41058D-380C-4098-96FB-53CC158ED420",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "BFE12226-C599-45A2-8CFD-32753F94204B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "C06F8832-B32F-4352-B048-A4ADCE85373E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "5278C685-988B-40D7-9AE9-B4FB8AF41C8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C6C6B20B-2E5D-4D25-885A-227A4BE5EEBB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.3.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F2FF7251-031D-4A9B-9AF0-1FFE556456D5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.4.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4D942D17-1AA9-4D5A-8F5E-0F4F762522D8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A2519BF-5F68-4096-8DE2-2C7BCF7200D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B00BD71-2AE5-47BA-999A-7E89590B86C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA6701A9-78CC-49D0-A40A-CB1C774400AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "40B5A7F2-B5B2-46CF-BBD0-AB986A8E55EC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DBEBD56F-EFBC-4620-A77C-E215A7AFDAFE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "5C45EA44-ECD1-40A7-89CE-D770BDC9DB4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "83088B0F-A6F8-4F47-99C0-09FEA234272F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "17E948D4-6C1A-43D2-B128-1A728FD61703",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "6470915C-CA3C-42CA-B69B-0FC40A33D02D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.6.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "759505BA-6F19-4BAE-8297-D8F30EEC8D8C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0A98CC34-2DB7-46CD-AA60-A7C08DDF22B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.7.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E424B63B-DCD8-4209-A4CB-84C1EDF5B255",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "F9576AA2-2FDD-4063-8D84-DE8DB063AC54",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "544368B2-37BE-41DD-8DC2-F04B6A394696",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "14A6B570-09CE-4AFF-AC8C-51F37FC79811",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "EC5670FB-B9EA-4B9C-BB7B-575494F12CA2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "27650033-1C9F-4175-A26F-D9082A36F079",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "7F1D35E0-2033-4ADE-9ADA-3B45996B53B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.9.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6205775B-4A83-498F-A60E-54473F5D5704",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.9.1-5:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8BCDB83-93ED-43CC-9D12-FAB227BE48CE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "39A6382B-A08C-4D58-B3F9-D74132A74B86",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.10.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7483B9F2-246C-4B78-9EFA-7734B7209054",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.10.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "A83436B8-AFC9-4AA2-8414-1F703812718D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.10.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCA47F54-B59B-45EC-B5D4-DF544E4BE1AF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.10.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "4786DEA6-6F23-4969-B7E0-C664FCB2284E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.10.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "EA3CABBB-9C1F-4ACD-A2AC-8320348DDA99",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.10.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0ED046D-26E2-4E01-BAB1-F86249A2E827",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "94A2973F-4CDA-4B8D-8331-FD14394AB906",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.11.0:rc0:*:*:*:*:*:*",
              "matchCriteriaId": "A4EF80C9-6950-412E-975F-058F20DF9F04",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.11.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "921698C0-DCE3-4604-8ED3-B327273D6EAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.11.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "F75C73E2-9137-4EAB-8D76-B0B22C391A2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.11.0-rc0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4BE2585F-9F3C-445C-B0A4-CC214B23F2B3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.11.0-rc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F061815-F34A-431A-9BF3-020348CB5C45",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.11.0-rc2:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE5017A8-9600-422D-A612-CBEF1C3A1E1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.11.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "340D614F-7B0B-4CB3-AEF3-26360FADF67C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.12.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C71C7DAD-86D5-4E9B-9549-C9FBD48AE22C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.12.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "37E501EA-4C70-48F1-9822-5575AFAA8783",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.12.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "77FCC2AD-2FDA-484B-B4A6-D842404DEE59",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.12.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "B48D2B63-5171-45E6-BF19-DFC63FA6683D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.12.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "7750C948-7169-44F1-A834-AE52BFBDC701",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.12.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD07B7AA-7237-44A9-B8BB-ACEC48BAFBEF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.12.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD38AD65-FF40-431B-BA2C-D55A7D0737A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.12.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "36233339-A9DF-4ACD-89A6-F79CB07E1568",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.13.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "F385658D-5D5C-49E6-8C67-FE4321CDCE1D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.13.0:rc0:*:*:*:*:*:*",
              "matchCriteriaId": "0A74A421-6012-4BEC-802D-7A05D20AF285",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.13.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "EB41C21C-B250-40D1-ADC1-B03866794417",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.14.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "77768E6F-408A-48A7-9F67-B8E1760DBA11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.14.0:rc0:*:*:*:*:*:*",
              "matchCriteriaId": "8162E07B-718E-41B3-B19C-A933CC1E2710",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.14.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "A0229959-6909-482B-9446-68C9B3021510",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.14.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "7048A380-A251-42D7-B081-CDB38B6A27F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.14.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "6EA71FFE-E41F-4128-A598-EDF446D9A045",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.15.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "EE446FA1-FBB8-4B76-904C-F4664703BFBD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:0.15.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "80621FFA-6189-47CD-9A6A-1D5A781862AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "5E66599D-9EC4-409C-BD26-62EC3B001984",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "1CF80F8D-5402-4AA6-ABB1-EEBD8EA0BBDB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.0:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "92FE0592-3611-4F93-A0B2-73ADFBF87FB8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.0:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "795EDF48-6FE0-4DE7-A57F-632BF0043677",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.0:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "17B83487-28EC-4EF0-9703-BD86384C1276",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "15A780B6-2BF3-480C-A519-16D1BFF2FC5D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "E8771F32-FFD2-43BD-B660-2CA8F6C41C5D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.1:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "01E89E31-F32D-4035-8923-7A5728E75DDF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.1:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "436BABC6-3D1C-4945-AADF-ED4D7C686E35",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.1:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "C3307CBF-525D-4F66-A7A6-B0B273C0BD7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:qemu:qemu:1.1:rc4:*:*:*:*:*:*",
              "matchCriteriaId": "E0A03725-CE1B-451F-8E14-9168E417692C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to \"active qemu timers.\""
    },
    {
      "lang": "es",
      "value": "La funci\u00f3n pciej_write en hw/acpi_piix4.c en la emulaci\u00f3n de PIIX4 Power Management en qemu-kvm no comprueba si un dispositivo es conectable en caliente antes de desconectar el puente PCI-ISA, lo que permite causar una denegaci\u00f3n de servicio y posiblemente ejecutar c\u00f3digo de su elecci\u00f3n a los usuarios privilegiados invitados mediante el env\u00edo de un valor espec\u00edfico al puerto I/O 0xae08 (PCI_EJ_BASE), lo que provoca a un uso despu\u00e9s de liberaci\u00f3n relacionado con \"temporizadores qemu activos\"."
    }
  ],
  "id": "CVE-2011-1751",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "ADJACENT_NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 7.4,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:A/AC:M/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 4.4,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-06-21T15:55:09.613",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://blog.nelhage.com/2011/08/breaking-out-of-kvm/"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=505597e4476a6bc219d0ec1362b760d71cb4fdca"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.nongnu.org/archive/html/qemu-devel/2011-05/msg01810.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://lists.opensuse.org/opensuse-updates/2011-05/msg00043.html"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://rhn.redhat.com/errata/RHSA-2011-0534.html"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44393"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44458"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44648"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44658"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44660"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44900"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2011/05/19/2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.osvdb.org/73395"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.securityfocus.com/bid/47927"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=699773"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://github.com/nelhage/virtunoid"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://hermes.opensuse.org/messages/8572547"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://www.ubuntu.com/usn/USN-1145-1/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://blog.nelhage.com/2011/08/breaking-out-of-kvm/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=505597e4476a6bc219d0ec1362b760d71cb4fdca"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.nongnu.org/archive/html/qemu-devel/2011-05/msg01810.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-updates/2011-05/msg00043.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://rhn.redhat.com/errata/RHSA-2011-0534.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44393"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44458"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44648"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44658"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44660"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/44900"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2011/05/19/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.osvdb.org/73395"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/47927"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=699773"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/nelhage/virtunoid"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://hermes.opensuse.org/messages/8572547"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.ubuntu.com/usn/USN-1145-1/"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.