CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 7.4
CWE Name:  Improper Input Validation
Summary: the pciej_write function in hw/acpi_piix4.c in the piix4 power management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the pci-isa bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (pci_ej_base) i/o port, which leads to a use-after-free related to "active qemu timers."
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: ADJACENT_NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2012-06-21
Last Modified Date: 2016-12-08