REDHAT-BUG-717399

First published: Tue Jun 28 2011(Updated: )

The virtio_queue_notify() function checks that the virtqueue number is less than the maximum number of virtqueues. A signed comparison is used but the virtqueue number could be negative if a buggy or malicious guest is run. This results in memory accesses outside of the virtqueue array. To trigger this issue the attacker needs to issue 32bit write to Queue Notify field of Virtio Header in the virtio pci config space even though the field is 16bit only by specs. Qemu-kvm allows that for the moment and provides whole 32bit value to the underlying functions. Unprivileged guest user could use this flaw to crash the guest (denial of service) or, possibly, escalate their privileges on the host. Upstream patch: <a href="http://patchwork.ozlabs.org/patch/94604/">http://patchwork.ozlabs.org/patch/94604/</a>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-bugzilla
• alias/CVE-2011-2512
• agent/type
• agent/last-modified-date
• agent/first-publish-date
• agent/softwarecombine
• agent/references
• agent/description
• agent/severity
• agent/tags
• agent/event
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/qemu
• canonical/qemu qemu-kvm