Description

A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) page 0x80 data. This malformed data, specifically an untrusted page length field, can lead to a stack buffer overflow in the `_sg_parse_vpd_80()` function during serial number parsing. Successful exploitation could result in a denial of service by crashing or destabilizing the process querying the serial number.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-09-21T21:17:17.847Z",
  "pubdate": "2026-09-21T21:17:17.847Z",
  "executiveSummary": "A critical memory safety vulnerability exists in libstoragemgmt, specifically within the serial number parsing logic for SCSI devices. The vulnerability is classified as a stack-based buffer overflow triggered by the processing of malformed Vital Product Data (VPD) page 0x80.\nThe flaw allows an attacker who controls a local or virtual storage device to provide a maliciously crafted page length field. This manipulation results in the writing of out-of-bounds data onto the process stack, potentially causing service instability or a complete crash of the storage management daemon.\nThe vulnerability requires the attacker to have control over a storage device that the system interacts with, posing a risk primarily to host systems or virtualized environments where untrusted storage devices are connected. Successful exploitation leads to a denial of service (DoS) state. There is no requirement for high-level network access, as the trigger occurs during the interrogation of local or virtual SCSI hardware interfaces.\nRisk implications include system-wide denial of service for storage management functions, which may impede administrative control or monitoring of storage resources. The integrity of the process execution flow is compromised, necessitating immediate updates or configuration changes to limit exposure to untrusted SCSI devices.",
  "technicalDetails": "The vulnerability resides in the _sg_parse_vpd_80() function within the libstoragemgmt library. This function is responsible for parsing the VPD page 0x80, which contains the unit serial number of a SCSI storage device. The root cause of the flaw is an insufficient validation of the length field provided within the SCSI VPD page header before performing a memory copy operation into a stack-allocated buffer.\nDuring the interrogation of a SCSI device, the software queries the VPD page 0x80 data. The protocol dictates that the device returns a structure containing a length field. If the attacker-controlled device provides an untrusted or unexpectedly large value in this length field, the _sg_parse_vpd_80() function fails to perform adequate bounds checking. Consequently, the data processing routine continues to copy the contents of the VPD page into the fixed-size stack buffer, exceeding the allocated memory capacity.\nThe exploitation flow follows these steps: First, an attacker establishes control over a local or virtual storage device (e.g., through a malicious virtual disk configuration or by masquerading as a SCSI-compliant device). Second, when libstoragemgmt triggers an inquiry or a serial number update, the malicious device responds with a VPD page 0x80 header containing a crafted length field designed to trigger an overflow. Third, as the _sg_parse_vpd_80() function processes the response, the overflow overwrites adjacent stack memory, potentially corrupting return pointers, local variables, or security cookies (canaries) if present.\nThe primary impact of this memory corruption is the destabilization of the libstoragemgmt process. By overwriting the stack, the attacker can force the application to execute invalid instructions or trigger a segmentation fault, resulting in a denial of service. While the primary impact noted is a process crash, such overflows in stack-based buffers often pose a risk for arbitrary code execution if the attacker can precisely control the data written and successfully bypass modern stack protection mechanisms. Because this process often runs with elevated privileges to communicate with hardware drivers, the potential for local privilege escalation or impact on the broader storage subsystem is significant, even if only a crash is currently confirmed."
}