The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.Security Fix(es): sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export (CVE-2026-16313) Bug Fix(es) and Enhancement(s): sginq output conformance for SCSI name string and ATA fields [rhel-9.6.z] (JIRA:RHEL-188129) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.Security Fix(es): sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export (CVE-2026-16313) Bug Fix(es) and Enhancement(s): sginq output conformance for SCSI name string and ATA fields [rhel-9.8.z] (JIRA:RHEL-188130) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.Security Fix(es): sg3utils: sg3utils: arbitrary command execution via udev property injection in sginq --export (CVE-2026-16313) Bug Fix(es) and Enhancement(s): sginq output conformance for SCSI name string and ATA fields [rhel-10.2.z] (JIRA:RHEL-188123) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.
sg3utils v1.34 through v1.48 contains a command injection flaw in exportdevids() in src/sginq.c. The sginq --export command outputs SCSI device identification data from VPD page 0x83 in KEY=VALUE format for udev import. The SCSI name string field (designator type 8, line 2046) and the ATA subfield (line 1922) are printed with printf("%.s") without sanitizing control characters. A newline embedded in a device-controlled name string splits a single property into two lines, allowing injection of arbitrary udev properties including REMOVECMD. Combined with the default udev rule in 50-udev-default.rules that executes REMOVECMD on device removal, this enables arbitrary root command execution when a crafted SCSI device is disconnected. CWE-93. Introduced in commit c410806c (2012-02-23). Fixed upstream in PR #83.