Description
The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | qemu-kvm | 0.12.5+dfsg-5+squeeze2 | DSA-2241-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | qemu-img +2 | 2:0.12.1.2-2.160.el6 | RHSA-2011:0534 |
Advisories 2
- RHSA-2011:0534 Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2241-1 qemu-kvm - implementation error Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20110519 CVE-2011-1751 qemu: acpi_piix4: missing hotplug check during device removal mailing-list
- RHSA-2011:0534 vendor-advisory
- http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=505597e4476a6bc219d0ec1362b760d71cb4fdca
- 44648 third-party-advisory
- 73395 vdb-entry
- 44393 third-party-advisory
- 44658 third-party-advisory
- SUSE-SU-2011:0533 vendor-advisory
- [Qemu-devel] 20110519 [PATCH] Ignore pci unplug requests for unpluggable devices mailing-list
- 47927 vdb-entry
- https://github.com/nelhage/virtunoid
- https://bugzilla.redhat.com/show_bug.cgi?id=699773
- 44458 third-party-advisory
- 44660 third-party-advisory
- http://blog.nelhage.com/2011/08/breaking-out-of-kvm/
- USN-1145-1 vendor-advisory
- 44900 third-party-advisory
- openSUSE-SU-2011:0510 vendor-advisory