REDHAT-BUG-2502845: Command Injection
sg3utils v1.34 through v1.48 contains a command injection flaw in exportdevids() in src/sginq.c. The sginq --export command outputs SCSI device identification data from VPD page 0x83 in KEY=VALUE format for udev import. The SCSI name string field (designator type 8, line 2046) and the ATA subfield (line 1922) are printed with printf("%.s") without sanitizing control characters. A newline embedded in a device-controlled name string splits a single property into two lines, allowing injection of arbitrary udev properties including REMOVECMD. Combined with the default udev rule in 50-udev-default.rules that executes REMOVECMD on device removal, this enables arbitrary root command execution when a crafted SCSI device is disconnected. CWE-93. Introduced in commit c410806c (2012-02-23). Fixed upstream in PR #83.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
sg3_utilsto a version that resolves this vulnerability.Fixed in v1.34 through v1.48 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch PR #83
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2502845?
The severity of REDHAT-BUG-2502845 is high, rated at 7.
What flaw is present in REDHAT-BUG-2502845?
REDHAT-BUG-2502845 contains a command injection flaw in the export_dev_ids() function of sg3_utils.
How does the command injection flaw in REDHAT-BUG-2502845 impact the software?
The command injection flaw in REDHAT-BUG-2502845 allows manipulation of SCSI device identification data output by the sg_inq --export command.
What versions of sg3_utils are affected by REDHAT-BUG-2502845?
sg3_utils versions 1.34 through 1.48 are affected by REDHAT-BUG-2502845.
How can I mitigate the vulnerability identified in REDHAT-BUG-2502845?
Mitigation for REDHAT-BUG-2502845 typically involves updating to a patched version of sg3_utils.