CVE-2011-3346: Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow...

Security readout for executives and security teams

This is an old QEMU SCSI CD-ROM flaw that could let a permitted guest user crash a virtual guest. The documented impact is denial of service, not host takeover. Exposure appears narrow because the CVE notes it only applies when root manually changed certain permissions or ACLs. Likely limited to legacy QEMU or Xen deployments running QEMU before 0.15.2, especially where CD-ROM device access permissions or ACLs were manually relaxed. Low priority unless the organization still runs legacy QEMU or Xen stacks. Treat as a hygiene and legacy-risk issue: confirm patch status and remove unusual guest device permissions. Mitigation focus: Upgrade QEMU or vendor virtualization packages to a fixed release, including QEMU 0.15.2 or later where applicable.; Apply relevant vendor advisories, such as Red Hat RHSA-2011:1401, for supported platforms.; Review guest CD-ROM permissions and ACLs for manual changes that broaden access..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.