CVE-2015-2756

Name of the Vulnerable Software and Affected Versions QEMU versions 3.3.x through 4.5.x

Description The issue is related to improper restriction of access to PCI command registers. This could allow local HVM guest users to cause a denial of service, resulting in a non-maskable interrupt and host crash. The denial of service can be triggered by disabling the memory or I/O decoding for a PCI Express device and then accessing the device, which leads to an Unsupported Request (UR) response.

Recommendations For QEMU versions 3.3.x through 4.5.x, consider restricting access to PCI command registers to prevent local HVM guest users from causing a denial of service. As a temporary workaround, restrict access to PCI Express devices to minimize the risk of exploitation.