The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
References
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2012-06-21T15:00:00
Updated: 2016-12-06T21:57:01
Reserved: 2011-04-19T00:00:00
Link: CVE-2011-1751
JSON object: View
NVD Information
Status : Modified
Published: 2012-06-21T15:55:09.613
Modified: 2023-02-13T04:30:49.203
Link: CVE-2011-1751
JSON object: View
Redhat Information
No data.
CWE