Every CVE Search/ Get API key

CVE-2011-1751

The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm...

7.4 HighFix available

The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."

Exploit likelihood

0.74%Down 1.4 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.4

The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."

Record
CVE-2011-1751
CVSS 2.0
7.4 HighAV:A/AC:M/Au:S/C:C/I:C/A:C
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."

Record
CVE-2011-1751
Updated
2026-11-02
EUVDEUVD-2011-1750 No score

The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."

Record
EUVD-2011-1750
Updated
2026-11-03
GitHub AdvisoriesGHSA-5x39-mv3c-q6cc No score

The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm...

The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."

Record
GHSA-5x39-mv3c-q6cc
Weakness
CWE-20
Updated
2026-11-02
OSVSUSE-SU-2015:0929-1 No score

Security update for kvm

The kvm qemu vt100 emulation was affected by a problem where specific vt100 sequences could have been used by guest users to affect the host. (CVE-2012-3515 aka XSA-17).

Also a temp file race was fixed. (CVE-2012-2652)

Security Issue reference:

* CVE-2012-3515
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3515>
* CVE-2012-2652
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2652>
Record
SUSE-SU-2015:0929-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qemu-kvm
Debian:6.0
 before 0.12.5+dfsg-5+squeeze2, plus listed versions
0.12.5+dfsg-50.12.5+dfsg-5+squeeze1
0.12.5+dfsg-5+squeeze2
qemu-img
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm-debuginfo
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm-tools
Red Hat:enterprise_linux:6::client
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-img
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm-debuginfo
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm-tools
Red Hat:enterprise_linux:6::computenode
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-img
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
Show 7 moreShow less
Affected packages
PackageAffectedFixed
qemu-kvm
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm-debuginfo
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm-tools
Red Hat:enterprise_linux:6::server
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-img
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm-debuginfo
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6
qemu-kvm-tools
Red Hat:enterprise_linux:6::workstation
From an advisory covering 2 CVEs
 before 2:0.12.1.2-2.160.el6
2:0.12.1.2-2.160.el6

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-1751 is a high vulnerability (CVSS 7.4) in Qemu, published May 24, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in qemu-kvm 0.12.5+dfsg-5+squeeze2.

References

Show 166 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open