CVE-2011-4347
Public on 2012-03-16
Modified on 2014-09-14
Description
The kvm_vm_ioctl_assign_device function in virt/kvm/assigned-dev.c in the KVM subsystem in the Linux kernel before 3.1.10 does not verify permission to access PCI configuration space and BAR resources, which allows host OS users to assign PCI devices and cause a denial of service (host OS crash) via a KVM_ASSIGN_PCI_DEVICE operation.
Severity
Medium
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | kernel | 2012-03-16 | ALAS-2012-55 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv2 | 4.0 | AV:L/AC:H/Au:N/C:N/I:N/A:C |
| NVD | CVSSv2 | 4.0 | AV:L/AC:H/Au:N/C:N/I:N/A:C |