{"id":"CVE-2014-3471","aliases":["DEBIAN-CVE-2014-3471","EUVD-2014-3483","GHSA-hfch-73vm-jx9g","UBUNTU-CVE-2014-3471","USN-2342-1"],"status":"published","title":"Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS...","description":"Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00396,"percentile":0.34002,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2014-06-26T00:00:00Z","modified":"2026-10-23T16:01:22Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.3"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.3"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2"],"bundled":32}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2014/06/23/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","article","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1112271","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://security.gentoo.org/glsa/glsa-201412-01.xml","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/68145","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2014-06/msg05283.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3471"},{"url":"https://github.com/advisories/GHSA-hfch-73vm-jx9g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3471","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-3471","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2342-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4148","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4149","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4150","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4151","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4526","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4527","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4530","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4531","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4532","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4533","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4534","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4536","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4537","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4538","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4539","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4540","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4541","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-4542","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-6399","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0142","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0145","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0146","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0222","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0223","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3461","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-3471","description":"Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.","status":"published","published":"2018-01-12T17:00:00Z","modified":"2024-08-06T10:43:06.364Z","updated_at":"2026-11-02T14:33:44.569327Z"}],"euvd":[{"id":"EUVD-2014-3483","description":"Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.","status":"published","published":"2018-01-12T17:00:00Z","modified":"2024-08-06T10:43:06Z","updated_at":"2026-11-03T01:57:10.864648Z"}],"ghsa":[{"id":"GHSA-hfch-73vm-jx9g","title":"Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS...","description":"Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.","status":"published","published":"2022-05-14T03:47:38Z","modified":"2023-02-03T05:00:35Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:52:49.509208Z"}],"nvd":[{"id":"CVE-2014-3471","description":"Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.","status":"published","published":"2018-01-12T17:29:00.193Z","modified":"2026-06-17T00:08:15.34Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:02:59.001778Z"}],"osv":[{"id":"CVE-2014-3471","description":"Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.","status":"published","published":"2018-01-12T17:29:00Z","modified":"2026-04-10T03:43:44.889094Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3471","description":"Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.","status":"published","published":"2018-01-12T17:29:00.193Z","modified":"2026-10-23T16:01:22.950981043Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"UBUNTU-CVE-2014-3471","description":"Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.","status":"published","published":"2014-06-26T00:00:00Z","modified":"2026-02-04T03:34:23.278914Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2342-1","title":"qemu, qemu-kvm vulnerabilities","description":"Michael S. Tsirkin, Anthony Liguori, and Michael Roth discovered multiple\nissues with QEMU state loading after migration. An attacker able to modify\nthe state data could use these issues to cause a denial of service, or\npossibly execute arbitrary code. (CVE-2013-4148, CVE-2013-4149,\nCVE-2013-4150, CVE-2013-4151, CVE-2013-4526, CVE-2013-4527, CVE-2013-4529,\nCVE-2013-4530, CVE-2013-4531, CVE-2013-4532, CVE-2013-4533, CVE-2013-4534,\nCVE-2013-4535, CVE-2013-4536, CVE-2013-4537, CVE-2013-4538, CVE-2013-4539,\nCVE-2013-4540, CVE-2013-4541, CVE-2013-4542, CVE-2013-6399, CVE-2014-0182,\nCVE-2014-3461)\n\nKevin Wolf, Stefan Hajnoczi, Fam Zheng, Jeff Cody, Stefan Hajnoczi, and\nothers discovered multiple issues in the QEMU block drivers. An attacker\nable to modify disk images could use these issues to cause a denial of\nservice, or possibly execute arbitrary code. (CVE-2014-0142, CVE-2014-0143,\nCVE-2014-0144, CVE-2014-0145, CVE-2014-0146, CVE-2014-0147, CVE-2014-0222,\nCVE-2014-0223)\n\nIt was discovered that QEMU incorrectly handled certain PCIe bus hotplug\noperations. A malicious guest could use this issue to crash the QEMU host,\nresulting in a denial of service. (CVE-2014-3471)\n","status":"published","published":"2014-09-08T17:35:27Z","modified":"2026-02-10T04:40:50Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}