CVE-2011-1751

The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management
emulation in qemu-kvm does not check if a device is hotpluggable before
unplugging the PCI-ISA bridge, which allows privileged guest users to cause
a denial of service (guest crash) and possibly execute arbitrary code by
sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads
to a use-after-free related to “active qemu timers.”

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=699773&gt;

Notes