CVE-2011-1751
CVE-2011-1751 is a high-severity vulnerability in Qemu with a CVSS 2.0 base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-20.
Key facts
- Severity: High (CVSS 2.0 base score 7.4)
- EPSS exploit prediction: 1% (51st percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-20
- Affected product: Qemu
- Published:
- Last modified:
Description
The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
Frequently asked questions
- What is CVE-2011-1751?
- The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."
- How severe is CVE-2011-1751?
- CVE-2011-1751 has a CVSS 2.0 base score of 7.4, rated high severity.
- Is CVE-2011-1751 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2011-1751?
- CVE-2011-1751 primarily affects Qemu. In total, 74 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2011-1751?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2011-1751 published?
- CVE-2011-1751 was published on 2012-06-21 and last updated on 2026-06-16.
References
- http://blog.nelhage.com/2011/08/breaking-out-of-kvm/
- http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commit%3Bh=505597e4476a6bc219d0ec1362b760d71cb4fdca
- http://lists.nongnu.org/archive/html/qemu-devel/2011-05/msg01810.html
- http://lists.opensuse.org/opensuse-updates/2011-05/msg00043.html
- http://rhn.redhat.com/errata/RHSA-2011-0534.html
- http://secunia.com/advisories/44393
- http://secunia.com/advisories/44458
- http://secunia.com/advisories/44648
- http://secunia.com/advisories/44658
- http://secunia.com/advisories/44660
- http://secunia.com/advisories/44900
- http://www.openwall.com/lists/oss-security/2011/05/19/2
- http://www.osvdb.org/73395
- http://www.securityfocus.com/bid/47927
- https://bugzilla.redhat.com/show_bug.cgi?id=699773
- https://github.com/nelhage/virtunoid
- https://hermes.opensuse.org/messages/8572547
- https://www.ubuntu.com/usn/USN-1145-1/
Affected products (74)
- cpe:2.3:a:qemu:qemu:0.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.9.1-5:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.11.0:rc0:*:*:*:*:*:*
- cpe:2.3:a:qemu:qemu:0.11.0:rc1:*:*:*:*:*:*
More vulnerabilities in Qemu
- CVE-2022-36648 — Critical (CVSS 10.0): The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier,…
- CVE-2017-16845 — Critical (CVSS 10.0): hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds…
- CVE-2015-8556 — Critical (CVSS 10.0): Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
- CVE-2009-3616 — Critical (CVSS 9.9): Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS…
- CVE-2019-12929 — Critical (CVSS 9.8): The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to…
- CVE-2019-12928 — Critical (CVSS 9.8): The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the…
Other CWE-20 (Improper Input Validation) vulnerabilities
- CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
- CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
- CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…
Browse all CWE-20 (Improper Input Validation) vulnerabilities →