CVE-2011-2512

The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly
validate the virtqueue number, which allows guest users to cause a denial
of service (guest crash) and possibly execute arbitrary code via a negative
number in the Queue Notify field of the Virtio Header, which bypasses a
signed comparison.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631975&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=717399&gt;