Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.
The MITRE CVE dictionary describes this issue as:
Find out more about CVE-2014-3471 from the MITRE CVE dictionary dictionary and NIST NVD.
This issue does not affect the versions of kvm package as shipped with Red Hat
Enterprise Linux 5.
This issue does not affect the versions of qemu-kvm package as shipped with Red Hat Enterprise Linux 6.
This issue does not affect the versions of qemu-kvm package as shipped with Red Hat Enterprise Linux 7.
NOTE: The following CVSS v2 metrics and score provided are preliminary and subject to review.
| Base Score | 5.7 |
|---|---|
| Base Metrics | AV:A/AC:M/Au:N/C:N/I:N/A:C |
| Access Vector | Adjacent Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | None |
| Availability Impact | Complete |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise Linux 7 | qemu-kvm-rhev | Will not fix |
| Red Hat Enterprise Linux 7 | qemu-kvm | Not affected |
| Red Hat Enterprise Linux 6 | qemu-kvm | Not affected |
| Red Hat Enterprise Linux 5 | kvm | Not affected |
Vulmon