CVE-2011-4622

The create_pit_timer function in arch/x86/kvm/i8254.c in KVM 83, and
possibly other versions, does not properly handle when Programmable
Interval Timer (PIT) interrupt requests (IRQs) when a virtual interrupt
controller (irqchip) is not available, which allows local users to cause a
denial of service (NULL pointer dereference) by starting a timer.
BUG: unable to handle kernel NULL pointer dereference at
0000000000000128
IP: [<ffffffffa10f6280>] kvm_set_irq+0x30/0x170 [kvm]
…
Call Trace:
[<ffffffffa11228c1>] pit_do_work+0x51/0xd0 [kvm]
[<ffffffff81071431>] process_one_work+0x111/0x4d0
[<ffffffff81071bb2>] worker_thread+0x152/0x340
[<ffffffff81075c8e>] kthread+0x7e/0x90
[<ffffffff815a4474>] kernel_thread_helper+0x4/0x10

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=769721&gt;
• <https://launchpad.net/bugs/911303&gt;