Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 24 May 2016 09:45:54 -0400 (EDT)
From: cve-assign@...re.org
To: ppandit@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, liqiang6-s@....cn
Subject: Re: CVE Request: Qemu: scsi: mptsas infinite loop in mptsas_fetch_requests

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> Quick Emulator(Qemu) built with the LSI SAS1068 Host Bus Adapter emulation
> support is vulnerable to an infinite loop issue. It could occur while fetching
> new requests in mptsas_fetch_requests().
> 
> A privileged user inside guest could use this flaw to consume excessive host
> resources or crash the Qemu process resulting in DoS.
> 
> https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04027.html

>> The LSI SAS1068 Host Bus Adapter emulator in Qemu, periodically
>> looks for requests and fetches them. A loop doing that in
>> mptsas_fetch_requests() could run infinitely if 's->state' was
>> not operational. Move check to avoid such a loop.

Use CVE-2016-4964.

This is not yet available at
http://git.qemu.org/?p=qemu.git;a=history;f=hw/scsi/mptsas.c but
that may be an expected place for a later update.

- -- 
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
  http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJXRFoUAAoJEHb/MwWLVhi2eREP/RhdpWO2TWtok4uMWzOC5tUE
w/MXH56dSTjvJUVVD7zD6LGNVaxXkjywiPNX49Pk4mibEKgXD1J1KnhsjpmroJes
3Lh1tU9ojMJYhSwQVTVvKakuo3zhDMm307nao8zLTyA1H44vAj0w8bYeqal3Q2+k
n86IVtv3AsjQQEWkFcAZbQBKw78Vkbg2DtYoBzy7Wp/7S99CyMy4EFQiWUI/2dVj
1uJdes2eAPawoPHI/1fKK9aGg3ZMslA6sw+vtBC9iQkYd99whBf0OiKgauJC5c8L
j0o7pedV+jwciDTAzFdTaM9yoVaoGhaH7QZY7NfBl3aWbZDaxJAZKicOWHFNXt0y
ePswqrHNhglshL0OwiZTlPktaz1o1iJxSjYEOYc1eY0X9y3peTg8+3gao+EAWDng
hbR2opWVdgjjy3Ob/tV1QSVASbZV+BSCavMUOcHf0ulQTHBRJOKXopGcY1Qmx8Ot
DhgDZINAhSSgrlBLvgfXYMlRKVm9MTZqfpjwQTr8kdHOpQljrHB00SJSAzI5uvlx
HdbTUonZvaTYSenkaK1D+L/8C+0hPZXrf7B1IyXh6QFILJAZ5+TYyzXxdajUoImg
jl1wPo5DS0i/wFO4Obt7phpf7MM2rabo1WDzolWiGU+glmVIuXFmEVa43d2eTBxz
ORKeSpt/xA4I3D98cYxe
=fzoY
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ