CVE-2011-2512 The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitra...
MediumCVSS 5.8
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header, which bypasses a signed comparison.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kvm group qemu-kvm | <= 0.14.0 | No fix listed |
| kvm group qemu-kvm | = 0.12 | No fix listed |
References
- git.kernel.org
- openSUSE-SU-2011:0803 vendor-advisory
- RHSA-2011:0919 vendor-advisory
- 44458 third-party-advisory vendor-advisory
- 44648 third-party-advisory vendor-advisory
- 45158 third-party-advisory vendor-advisory
- 45170 third-party-advisory vendor-advisory
- 45301 third-party-advisory vendor-advisory
- USN-1165-1 vendor-advisory
- [oss-security] 20110628 CVE request: qemu-kvm: OOB memory access caused by negative vq notifies mailing-list patch
- [oss-security] 20110629 Re: CVE request: qemu-kvm: OOB memory access caused by negative vq notifies mailing-list patch
- 74751 vdb-entry
- SUSE-SU-2011:0806 vendor-advisory
- DSA-2270 vendor-advisory