REDHAT-BUG-2502845: Command Injection

sg3utils v1.34 through v1.48 contains a command injection flaw in exportdevids() in src/sginq.c. The sginq --export command outputs SCSI device identification data from VPD page 0x83 in KEY=VALUE format for udev import. The SCSI name string field (designator type 8, line 2046) and the ATA subfield (line 1922) are printed with printf("%.s") without sanitizing control characters. A newline embedded in a device-controlled name string splits a single property into two lines, allowing injection of arbitrary udev properties including REMOVECMD. Combined with the default udev rule in 50-udev-default.rules that executes REMOVECMD on device removal, this enables arbitrary root command execution when a crafted SCSI device is disconnected. CWE-93. Introduced in commit c410806c (2012-02-23). Fixed upstream in PR #83.