UBUNTU-CVE-2011-4347

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2011-4347
Published: 25 Nov 2011, 00:00
Last modified:04 Feb 2026, 04:03

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

25 Nov 2011, 00:00
Published
Vulnerability first disclosed
04 Feb 2026, 04:03
Last Modified
Vulnerability information updated

Description

The kvm_vm_ioctl_assign_device function in virt/kvm/assigned-dev.c in the KVM subsystem in the Linux kernel before 3.1.10 does not verify permission to access PCI configuration space and BAR resources, which allows host OS users to assign PCI devices and cause a denial of service (host OS crash) via a KVM_ASSIGN_PCI_DEVICE operation. Please note that privileged access was still needed to re-program the device to for example issue DMA requests. This is typically achieved by touching files on sysfs filesystem. These files are usually not accessible to unprivileged users. As a result, local user could use this flaw to crash the system.

Affected Systems

  • ubuntu•linux

    < 3.11.0-12.19 | < 4.2.0-16.19

  • ubuntu•linux-aws

    < 4.4.0-1002.2 | < 4.4.0-1001.10

  • ubuntu•linux-flo

    < 3.4.0-1.3 | < 3.4.0-5.22

  • ubuntu•linux-gke

    < 4.4.0-1003.3

  • ubuntu•linux-goldfish

    < 3.4.0-1.9 | < 3.4.0-4.27

  • ubuntu•linux-hwe

    < 4.8.0-36.36~16.04.1

  • ubuntu•linux-lts-utopic

    < 3.16.0-25.33~14.04.2

  • ubuntu•linux-lts-vivid

    < 3.19.0-18.18~14.04.1

  • ubuntu•linux-lts-wily

    < 4.2.0-18.22~14.04.1

  • ubuntu•linux-lts-xenial

    < 4.4.0-13.29~14.04.1

  • ubuntu•linux-mako

    < 3.4.0-3.21 | < 3.4.0-7.40

  • ubuntu•linux-manta

    < 3.4.0-4.19

  • ubuntu•linux-raspi2

    < 4.2.0-1013.19

  • ubuntu•linux-snapdragon

    < 4.4.0-1012.12

References (16)