Severity : |
High
|
Published : |
2012-06-21
|
Modified : |
2013-02-13
|
Base Score : |
7.4
|
Details : |
The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
|
Product/Version : |
Carrier Grade CGE 6.0
|
|