CVE-2026-93433: 
Linux Red Hat Analyse et atténuation des vulnérabilités

CVE-2026-93433 is a stack-based buffer overflow vulnerability in libstoragemgmt affecting the _sg_parse_vpd_80() function during SCSI Vital Product Data (VPD) page 0x80 serial number parsing. An attacker with control over a local or virtual storage device can supply specially crafted VPD data with a malformed (untrusted) page length field, triggering a stack buffer overflow. The affected component is libstoragemgmt-1.10.1-4.el10 (Red Hat Enterprise Linux 10). It was disclosed on September 21, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-121 (Stack-based Buffer Overflow): in _sg_parse_vpd_80() (file c_binding/libsg.c), the serial number length is derived directly from the untrusted VPD header field page_len_be and used as the snprintf() destination size, without being bounded by the caller-provided serial_num_max_len. The code only validates that the VPD response stays within _SG_T10_SPC_VPD_MAX_LEN (a VPD buffer limit), not the size of the fixed 253-byte caller stack buffer. If page_len_be exceeds 252 and the payload is not NUL-terminated early, snprintf() writes past the stack buffer. The vulnerable call chain is: lsm_local_disk_serial_num_get() → _sysfs_serial_num_of_sd_name() → _sysfs_vpd_pg80_data_get() → _sg_parse_vpd_80() (Red Hat Bugzilla).

Successful exploitation results in a denial of service by crashing or destabilizing the process querying the storage device serial number via libstoragemgmt. There is no demonstrated confidentiality or integrity impact — the overflow causes stack corruption that leads to process crash or instability. The scope is limited to the consuming process, and exploitation requires local access and control over a storage device or virtual storage backend, significantly constraining the blast radius (Red Hat CVE, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to control or present malformed SCSI VPD page 0x80 data to the affected system, which limits practical exploitability. The Red Hat Bugzilla entry includes a reproduction harness using AddressSanitizer for internal validation purposes (Red Hat CVE, GitHub Advisory).

1. Gain local access: Obtain low-privileged local access to a system running a vulnerable version of libstoragemgmt (e.g., libstoragemgmt-1.10.1-4.el10 on RHEL 10).
2. Control or emulate a storage device: Set up a virtual or local storage device (e.g., a virtual SCSI device or a storage backend) that can return attacker-controlled SCSI VPD page 0x80 responses.
3. Craft malformed VPD data: Construct a VPD page 0x80 response where the page_len_be field is set to a value exceeding 252 (e.g., 0x0400), and fill the payload region with non-zero bytes without an early NUL terminator.
4. Trigger the vulnerable code path: Cause the target system to query the serial number of the controlled device, invoking lsm_local_disk_serial_num_get() → _sg_parse_vpd_80(), which passes the untrusted length directly to snprintf().
5. Achieve denial of service: The oversized snprintf() write overflows the 253-byte caller stack buffer, corrupting the stack and crashing or destabilizing the querying process (Red Hat Bugzilla).

• Logs: Unexpected crashes or segmentation faults in processes invoking lsm_local_disk_serial_num_get() or related libstoragemgmt functions; core dump files generated by the affected process.
• Process: Abnormal termination of storage management daemons or tools that query disk serial numbers via libstoragemgmt.
• File System: Presence of core dump files (e.g., core.*) in directories associated with storage management processes.
• Storage: Unusual or malformed SCSI VPD page 0x80 responses from local or virtual storage devices, particularly with page_len_be values exceeding 252 (Red Hat Bugzilla).

No released package fix was available at the time of disclosure; a proposed patch has been submitted that bounds the snprintf() copy by serial_num_max_len rather than the untrusted VPD length field. As a workaround, Red Hat recommends avoiding queries of local disk serial numbers from untrusted or attacker-controlled storage devices or virtual storage backends, and configuring systems to reject or sanitize malformed SCSI VPD page 0x80 data before it is processed by libstoragemgmt. Monitor the Red Hat Customer Portal and Bugzilla entry for patch availability (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat, and Red Hat has classified it as Moderate severity. No notable public researcher commentary, social media discussion, or significant media coverage has been identified beyond the standard advisory and database entries.