NVD Vulnerability Detail

CVE-2011-1751

Summary	The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
Publication Date	June 22, 2012, 12:55 a.m.
Registration Date	Jan. 28, 2021, 4:38 p.m.
Last Update	Nov. 21, 2024, 10:26 a.m.

CVSS2.0 : HIGH
Score	7.4
Vector	AV:A/AC:M/Au:S/C:C/I:C/A:C
攻撃元区分(AV)	隣接
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	単一
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:qemu:qemu:1.0:rc1::::::
cpe:2.3:a:qemu:qemu:0.12.2:::::::*
cpe:2.3:a:qemu:qemu:0.12.0:rc2::::::
cpe:2.3:a:qemu:qemu:1.1:rc3::::::
cpe:2.3:a:qemu:qemu:0.1.6:::::::*
cpe:2.3:a:qemu:qemu:0.13.0:rc0::::::
cpe:2.3:a:qemu:qemu:0.5.3:::::::*
cpe:2.3:a:qemu:qemu:0.4.2:::::::*
cpe:2.3:a:qemu:qemu:1.0:rc2::::::
cpe:2.3:a:qemu:qemu:0.10.3:::::::*
cpe:2.3:a:qemu:qemu:0.11.0-rc1:::::::*
cpe:2.3:a:qemu:qemu:0.1.5:::::::*
cpe:2.3:a:qemu:qemu:0.13.0:::::::*
cpe:2.3:a:qemu:qemu:0.5.1:::::::*
cpe:2.3:a:qemu:qemu:0.8.2:::::::*
cpe:2.3:a:qemu:qemu:0.11.0:rc1::::::
cpe:2.3:a:qemu:qemu:1.1:rc4::::::
cpe:2.3:a:qemu:qemu:0.5.5:::::::*
cpe:2.3:a:qemu:qemu:0.10.1:::::::*
cpe:2.3:a:qemu:qemu:0.9.0:::::::*
cpe:2.3:a:qemu:qemu:1.0:::::::*
cpe:2.3:a:qemu:qemu:1.1:rc2::::::
cpe:2.3:a:qemu:qemu:0.7.2:::::::*
cpe:2.3:a:qemu:qemu:0.11.0:rc2::::::
cpe:2.3:a:qemu:qemu:0.12.5:::::::*
cpe:2.3:a:qemu:qemu:0.11.0:::::::*
cpe:2.3:a:qemu:qemu:0.1.3:::::::*
cpe:2.3:a:qemu:qemu:0.14.0:rc0::::::
cpe:2.3:a:qemu:qemu:0.12.0:rc1::::::
cpe:2.3:a:qemu:qemu:0.11.1:::::::*
cpe:2.3:a:qemu:qemu:0.7.1:::::::*
cpe:2.3:a:qemu:qemu:0.9.1-5:::::::*
cpe:2.3:a:qemu:qemu:1.0.1:::::::*
cpe:2.3:a:qemu:qemu:1.0:rc3::::::
cpe:2.3:a:qemu:qemu:0.13.0:rc1::::::
cpe:2.3:a:qemu:qemu:0.15.0:rc1::::::
cpe:2.3:a:qemu:qemu:0.5.0:::::::*
cpe:2.3:a:qemu:qemu:0.12.0:::::::*
cpe:2.3:a:qemu:qemu:0.14.1:::::::*
cpe:2.3:a:qemu:qemu:0.8.1:::::::*
cpe:2.3:a:qemu:qemu:0.11.0-rc2:::::::*
cpe:2.3:a:qemu:qemu:0.10.0:::::::*
cpe:2.3:a:qemu:qemu:0.4.1:::::::*
cpe:2.3:a:qemu:qemu:0.5.2:::::::*
cpe:2.3:a:qemu:qemu:0.12.3:::::::*
cpe:2.3:a:qemu:qemu:0.1.1:::::::*
cpe:2.3:a:qemu:qemu:0.7.0:::::::*
cpe:2.3:a:qemu:qemu:0.11.0:rc0::::::
cpe:2.3:a:qemu:qemu:0.1.4:::::::*
cpe:2.3:a:qemu:qemu:0.9.1:::::::*
cpe:2.3:a:qemu:qemu:0.6.0:::::::*
cpe:2.3:a:qemu:qemu:0.6.1:::::::*
cpe:2.3:a:qemu:qemu:0.14.0:rc2::::::
cpe:2.3:a:qemu:qemu:0.10.6:::::::*
cpe:2.3:a:qemu:qemu:0.14.0:rc1::::::
cpe:2.3:a:qemu:qemu:0.14.0:::::::*
cpe:2.3:a:qemu:qemu:0.11.0-rc0:::::::*
cpe:2.3:a:qemu:qemu:0.4.3:::::::*
cpe:2.3:a:qemu:qemu:0.1.2:::::::*
cpe:2.3:a:qemu:qemu:0.5.4:::::::*
cpe:2.3:a:qemu:qemu:0.12.4:::::::*
cpe:2.3:a:qemu:qemu:0.10.5:::::::*
cpe:2.3:a:qemu:qemu:1.0:rc4::::::
cpe:2.3:a:qemu:qemu:0.10.4:::::::*
cpe:2.3:a:qemu:qemu:0.10.2:::::::*
cpe:2.3:a:qemu:qemu:0.15.0:rc2::::::
cpe:2.3:a:qemu:qemu:1.1:rc1::::::
cpe:2.3:a:qemu:qemu:1.1:::::::*
cpe:2.3:a:qemu:qemu:0.12.1:::::::*
cpe:2.3:a:qemu:qemu:0.8.0:::::::*
cpe:2.3:a:qemu:qemu:0.1.0:::::::*
cpe:2.3:a:qemu:qemu:0.2.0:::::::*
cpe:2.3:a:qemu:qemu:0.3.0:::::::*
cpe:2.3:a:qemu:qemu:0.4.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://blog.nelhage.com/2011/08/breaking-out-of-kvm/
2	http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=505597e4476a6bc219d0ec1362b760d71cb4fdca
3	http://lists.nongnu.org/archive/html/qemu-devel/2011-05/msg01810.html
4	http://lists.opensuse.org/opensuse-updates/2011-05/msg00043.html
5	http://rhn.redhat.com/errata/RHSA-2011-0534.html
6	http://secunia.com/advisories/44393	Vendor Advisory
7	http://secunia.com/advisories/44458	Vendor Advisory
8	http://secunia.com/advisories/44648	Vendor Advisory
9	http://secunia.com/advisories/44658	Vendor Advisory
10	http://secunia.com/advisories/44660	Vendor Advisory
11	http://secunia.com/advisories/44900	Vendor Advisory
12	http://www.openwall.com/lists/oss-security/2011/05/19/2
13	http://www.osvdb.org/73395
14	http://www.securityfocus.com/bid/47927
15	https://bugzilla.redhat.com/show_bug.cgi?id=699773
16	https://github.com/nelhage/virtunoid
17	https://hermes.opensuse.org/messages/8572547
18	https://www.ubuntu.com/usn/USN-1145-1/
19	http://blog.nelhage.com/2011/08/breaking-out-of-kvm/
20	https://www.ubuntu.com/usn/USN-1145-1/
21	https://hermes.opensuse.org/messages/8572547
22	https://github.com/nelhage/virtunoid
23	https://bugzilla.redhat.com/show_bug.cgi?id=699773
24	http://www.securityfocus.com/bid/47927
25	http://www.osvdb.org/73395
26	http://www.openwall.com/lists/oss-security/2011/05/19/2
27	http://secunia.com/advisories/44900	Vendor Advisory
28	http://secunia.com/advisories/44660	Vendor Advisory
29	http://secunia.com/advisories/44658	Vendor Advisory
30	http://secunia.com/advisories/44648	Vendor Advisory
31	http://secunia.com/advisories/44458	Vendor Advisory
32	http://secunia.com/advisories/44393	Vendor Advisory
33	http://rhn.redhat.com/errata/RHSA-2011-0534.html
34	http://lists.opensuse.org/opensuse-updates/2011-05/msg00043.html
35	http://lists.nongnu.org/archive/html/qemu-devel/2011-05/msg01810.html
36	http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=505597e4476a6bc219d0ec1362b760d71cb4fdca

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

qemu-kvm の pciej_write 関数におけるサービス運用妨害 (ゲストクラッシュ) の脆弱性

Title	qemu-kvm の pciej_write 関数におけるサービス運用妨害 (ゲストクラッシュ) の脆弱性
Summary	qemu-kvm の PIIX4 Power Management エミュレーションにおける hw/acpi_piix4.c 内の pciej_write 関数は、PCI-ISA ブリッジが取り外される前に、デバイスに対するホットプラグの対応の有無を確認しないため、サービス運用妨害 (ゲストクラッシュ) 状態となる、および任意のコードを実行される脆弱性が存在します。
Possible impacts	特権を持つゲストユーザにより、I/O ポート 0xae08 (PCI_EJ_BASE) に対して、巧妙に細工された値を送信されることで、サービス運用妨害 (ゲストクラッシュ) 状態にされる、および任意のコードを実行される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 21, 2012, midnight
Registration Date	June 22, 2012, 4:49 p.m.
Last Update	June 22, 2012, 4:49 p.m.

Affected System

Fabrice Bellard

QEMU

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-1751	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1751
National Vulnerability Database (NVD)
2	CVE-2011-1751	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-1751

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
kernel.org
1	Ignore pci unplug requests for unpluggable devices (CVE-2011-1751)	http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commit;h=505597e4476a6bc219d0ec1362b760d71cb4fdca
opensuse-security-announce
2	openSUSE-SU-2011:0510	http://lists.opensuse.org/opensuse-updates/2011-05/msg00043.html
QEMU
3	Top Page	http://wiki.qemu.org/Main_Page
Red Hat Bugzilla
4	Bug 699773	https://bugzilla.redhat.com/show_bug.cgi?id=699773
Red Hat Security Advisory
5	RHSA-2011:0534	http://rhn.redhat.com/errata/RHSA-2011-0534.html
Ubuntu Security Notice
6	USN-1145-1	http://www.ubuntu.com/usn/usn-1145-1/

その他

No	Name	URL
関連文書
1	Nelson Elhage - BlackHat/DEFCON 2011 talk: Breaking out of KVM	http://blog.nelhage.com/2011/08/breaking-out-of-kvm/
2	Nelson Elhage - My KVM breakout code from my DEFCON/Black Hat 2011 presentation	https://github.com/nelhage/virtunoid

Change Log

No	Changed Details	Date of change
0	[2012年06月22日] 掲載	Feb. 17, 2018, 10:37 a.m.

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:qemu:qemu:1.0:rc1::::::
cpe:2.3:a:qemu:qemu:0.12.2:::::::*
cpe:2.3:a:qemu:qemu:0.12.0:rc2::::::
cpe:2.3:a:qemu:qemu:1.1:rc3::::::
cpe:2.3:a:qemu:qemu:0.1.6:::::::*
cpe:2.3:a:qemu:qemu:0.13.0:rc0::::::
cpe:2.3:a:qemu:qemu:0.5.3:::::::*
cpe:2.3:a:qemu:qemu:0.4.2:::::::*
cpe:2.3:a:qemu:qemu:1.0:rc2::::::
cpe:2.3:a:qemu:qemu:0.10.3:::::::*
cpe:2.3:a:qemu:qemu:0.11.0-rc1:::::::*
cpe:2.3:a:qemu:qemu:0.1.5:::::::*
cpe:2.3:a:qemu:qemu:0.13.0:::::::*
cpe:2.3:a:qemu:qemu:0.5.1:::::::*
cpe:2.3:a:qemu:qemu:0.8.2:::::::*
cpe:2.3:a:qemu:qemu:0.11.0:rc1::::::
cpe:2.3:a:qemu:qemu:1.1:rc4::::::
cpe:2.3:a:qemu:qemu:0.5.5:::::::*
cpe:2.3:a:qemu:qemu:0.10.1:::::::*
cpe:2.3:a:qemu:qemu:0.9.0:::::::*
cpe:2.3:a:qemu:qemu:1.0:::::::*
cpe:2.3:a:qemu:qemu:1.1:rc2::::::
cpe:2.3:a:qemu:qemu:0.7.2:::::::*
cpe:2.3:a:qemu:qemu:0.11.0:rc2::::::
cpe:2.3:a:qemu:qemu:0.12.5:::::::*
cpe:2.3:a:qemu:qemu:0.11.0:::::::*
cpe:2.3:a:qemu:qemu:0.1.3:::::::*
cpe:2.3:a:qemu:qemu:0.14.0:rc0::::::
cpe:2.3:a:qemu:qemu:0.12.0:rc1::::::
cpe:2.3:a:qemu:qemu:0.11.1:::::::*
cpe:2.3:a:qemu:qemu:0.7.1:::::::*
cpe:2.3:a:qemu:qemu:0.9.1-5:::::::*
cpe:2.3:a:qemu:qemu:1.0.1:::::::*
cpe:2.3:a:qemu:qemu:1.0:rc3::::::
cpe:2.3:a:qemu:qemu:0.13.0:rc1::::::
cpe:2.3:a:qemu:qemu:0.15.0:rc1::::::
cpe:2.3:a:qemu:qemu:0.5.0:::::::*
cpe:2.3:a:qemu:qemu:0.12.0:::::::*
cpe:2.3:a:qemu:qemu:0.14.1:::::::*
cpe:2.3:a:qemu:qemu:0.8.1:::::::*
cpe:2.3:a:qemu:qemu:0.11.0-rc2:::::::*
cpe:2.3:a:qemu:qemu:0.10.0:::::::*
cpe:2.3:a:qemu:qemu:0.4.1:::::::*
cpe:2.3:a:qemu:qemu:0.5.2:::::::*
cpe:2.3:a:qemu:qemu:0.12.3:::::::*
cpe:2.3:a:qemu:qemu:0.1.1:::::::*
cpe:2.3:a:qemu:qemu:0.7.0:::::::*
cpe:2.3:a:qemu:qemu:0.11.0:rc0::::::
cpe:2.3:a:qemu:qemu:0.1.4:::::::*
cpe:2.3:a:qemu:qemu:0.9.1:::::::*
cpe:2.3:a:qemu:qemu:0.6.0:::::::*
cpe:2.3:a:qemu:qemu:0.6.1:::::::*
cpe:2.3:a:qemu:qemu:0.14.0:rc2::::::
cpe:2.3:a:qemu:qemu:0.10.6:::::::*
cpe:2.3:a:qemu:qemu:0.14.0:rc1::::::
cpe:2.3:a:qemu:qemu:0.14.0:::::::*
cpe:2.3:a:qemu:qemu:0.11.0-rc0:::::::*
cpe:2.3:a:qemu:qemu:0.4.3:::::::*
cpe:2.3:a:qemu:qemu:0.1.2:::::::*
cpe:2.3:a:qemu:qemu:0.5.4:::::::*
cpe:2.3:a:qemu:qemu:0.12.4:::::::*
cpe:2.3:a:qemu:qemu:0.10.5:::::::*
cpe:2.3:a:qemu:qemu:1.0:rc4::::::
cpe:2.3:a:qemu:qemu:0.10.4:::::::*
cpe:2.3:a:qemu:qemu:0.10.2:::::::*
cpe:2.3:a:qemu:qemu:0.15.0:rc2::::::
cpe:2.3:a:qemu:qemu:1.1:rc1::::::
cpe:2.3:a:qemu:qemu:1.1:::::::*
cpe:2.3:a:qemu:qemu:0.12.1:::::::*
cpe:2.3:a:qemu:qemu:0.8.0:::::::*
cpe:2.3:a:qemu:qemu:0.1.0:::::::*
cpe:2.3:a:qemu:qemu:0.2.0:::::::*
cpe:2.3:a:qemu:qemu:0.3.0:::::::*
cpe:2.3:a:qemu:qemu:0.4.0:::::::*