CVE-2026-16313: Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
Other sources
sg3utils v1.34 through v1.48 contains a command injection flaw in exportdevids() in src/sginq.c. The sginq --export command outputs SCSI device identification data from VPD page 0x83 in KEY=VALUE format for udev import. The SCSI name string field (designator type 8, line 2046) and the ATA subfield (line 1922) are printed with printf("%.s") without sanitizing control characters. A newline embedded in a device-controlled name string splits a single property into two lines, allowing injection of arbitrary udev properties including REMOVECMD. Combined with the default udev rule in 50-udev-default.rules that executes REMOVECMD on device removal, this enables arbitrary root command execution when a crafted SCSI device is disconnected. CWE-93. Introduced in commit c410806c (2012-02-23). Fixed upstream in PR #83.
— Red Hat
Sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/sg3-utilsto a version that resolves this vulnerability.Fixed in 1.48-4 - Upgrade
Upgrade
sg3_utilsto a version that resolves this vulnerability.Patch PR #83
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16313?
The severity of CVE-2026-16313 is classified as high, with a score of 7.6.
What type of vulnerability is CVE-2026-16313?
CVE-2026-16313 is a CRLF Injection vulnerability that allows for arbitrary command execution.
How does CVE-2026-16313 exploit occur?
The exploit occurs through the sg_inq command when it outputs device identification data containing unsanitized control characters.
How do I fix CVE-2026-16313?
To fix CVE-2026-16313, users should apply the latest updates to sg3_utils that address the udev property injection issue.
What impact does CVE-2026-16313 have on system security?
CVE-2026-16313 can lead to arbitrary command execution, allowing attackers to manipulate system properties and potentially compromise security.