CVE-2011-2512

The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue...

5.8 MediumFix available

The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header, which bypasses a signed comparison.

Exploit likelihood

1.88%Down 0.8 points since Feb 4, 2022

What each source reports

NVD Score used 5.8

Record: CVE-2011-2512
CVSS 2.0: 5.8 MediumAV:A/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-2512
Updated: 2026-11-02

EUVDEUVD-2011-2497 No score

Record: EUVD-2011-2497
Updated: 2026-11-03

GitHub AdvisoriesGHSA-g293-9rv5-w2qx No score

The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue...

Record: GHSA-g293-9rv5-w2qx
Weakness: CWE-20
Updated: 2026-11-02

OSVSUSE-SU-2015:0929-1 No score

Security update for kvm

The kvm qemu vt100 emulation was affected by a problem where specific vt100 sequences could have been used by guest users to affect the host. (CVE-2012-3515 aka XSA-17).

Also a temp file race was fixed. (CVE-2012-2652)

Security Issue reference:

* CVE-2012-3515
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515>
* CVE-2012-2652
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2652>

Record: SUSE-SU-2015:0929-1
Updated: 2026-11-02

Affected products

kvm group qemu-kvm

Affected packages

Affected packages
Package	Affected	Fixed
`qemu-kvm` Debian:6.0	before 0.12.5+dfsg-5+squeeze4, plus listed versions 0.12.5+dfsg-50.12.5+dfsg-5+squeeze10.12.5+dfsg-5+squeeze20.12.5+dfsg-5+squeeze30.12.5+dfsg-5+squeeze4~bpo50+1	0.12.5+dfsg-5+squeeze4
`qemu-img` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 2:0.12.1.2-2.160.el6_1.2	2:0.12.1.2-2.160.el6_1.2
`qemu-kvm` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 2:0.12.1.2-2.160.el6_1.2	2:0.12.1.2-2.160.el6_1.2
`qemu-kvm-debuginfo` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 2:0.12.1.2-2.160.el6_1.2	2:0.12.1.2-2.160.el6_1.2
`qemu-kvm-tools` Red Hat:enterprise_linux:6::server From an advisory covering 2 CVEs	before 2:0.12.1.2-2.160.el6_1.2	2:0.12.1.2-2.160.el6_1.2

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-2512 is a medium vulnerability (CVSS 5.8) in Kvm Group Qemu-kvm, published July 1, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.88%, the 79th percentile. Fixed in qemu-kvm 0.12.5+dfsg-5+squeeze4.

References

Show 61 moreShow less