The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via vectors involving s->state.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The mptsas_fetch_requests function in hw/scsi/mptsas.c in QEMU (aka Quick Emulator) allows local guest OS     administrators to cause a denial of service (infinite loop, and CPU consumption or QEMU process crash) via     vectors involving s->state. (CVE-2016-4964)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-201609-01 (QEMU: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QEMU. Please review the       CVE identifiers referenced below for details.
  Impact :

    Local users within a guest QEMU environment can execute arbitrary code       within the host or a cause a Denial of Service condition of the QEMU       guest process.
  Workaround :

    There is no known workaround at this time.

- CVE-2016-4002: net: buffer overflow in MIPSnet (bz     #1326083)

  - CVE-2016-4952 scsi: pvscsi: out-of-bounds access issue

  - CVE-2016-4964: scsi: mptsas infinite loop (bz #1339157)

  - CVE-2016-5106: scsi: megasas: out-of-bounds write (bz     #1339581)

  - CVE-2016-5105: scsi: megasas: stack information leakage     (bz #1339585)

  - CVE-2016-5107: scsi: megasas: out-of-bounds read (bz     #1339573)

  - CVE-2016-4454: display: vmsvga: out-of-bounds read (bz     #1340740)

  - CVE-2016-4453: display: vmsvga: infinite loop (bz     #1340744)

  - CVE-2016-5126: block: iscsi: buffer overflow (bz     #1340925)

  - CVE-2016-5238: scsi: esp: OOB write (bz #1341932)

  - CVE-2016-5338: scsi: esp: OOB r/w access (bz #1343325)

  - CVE-2016-5337: scsi: megasas: information leakage (bz     #1343910)

  - Fix crash with -nodefaults -sdl (bz #1340931)

  - Add deps on edk2-ovmf and edk2-aarch64

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
219576	Linux Distros Unpatched Vulnerability : CVE-2016-4964	Nessus	Misc.	Local	medium
93697	GLSA-201609-01 : QEMU: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
92277	Fedora 24 : 2:qemu (2016-a80eab65ba)	Nessus	Fedora Local Security Checks	Local	critical

Detections

Analytics

CVE-2016-4964

medium

Tenable Plugins

medium

critical

critical