CVE-2011-1751: Input Validation
The pciejwrite function in hw/acpipiix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCIEJBASE) I/O port, which leads to a use-after-free related to "active qemu timers."
Other sources
Writing the value 2 to I/O port 0xae08 ("PCIEJBASE") initiates the PIIX3 PCI-ISA bridge removal. Unplugging this causes all of the ISA devices to be unplugged and right now the ISA (in particularly the RTC) devices cannot handle unplug gracefuly.
During MC146818 removal RTCState structure backing the emulated RTC is freed but embedded timers are not unlinked from activetimers list. Next time the timer fires SIGSEGV occurs. RTCState embedds several QEMUTimer structures that define function pointers (callbacks) that get called when timer expires.
Since the memory is freed, however, it is possible, under some circumstances, for the guest to cause a controlled allocation into the freed space, which can ultimately be exploited for code execution in the context of the qemu or qemu-kvm process.
ASLR partially mitigates this issue.
Acknowledgements:
Red Hat would like to thank Nelson Elhage for reporting this issue.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1751?
CVE-2011-1751 has a medium severity rating due to the potential for a denial of service and possible arbitrary code execution.
How do I fix CVE-2011-1751?
To fix CVE-2011-1751, update to a patched version of QEMU KVM that addresses the hotplugging vulnerability.
Who is affected by CVE-2011-1751?
CVE-2011-1751 affects privileged guest users running certain versions of QEMU KVM that lack proper device checks.
What vulnerabilities does CVE-2011-1751 represent?
CVE-2011-1751 represents a vulnerability in the PIIX4 Power Management emulation of QEMU that can lead to guest crashes.
What types of systems are impacted by CVE-2011-1751?
CVE-2011-1751 impacts systems using QEMU KVM versions including 0.1.0 through 1.1-rc4.