Summary
The sg3_utils packages provide command-line utilities for devices that use the Small Computer System Interface (SCSI) command sets.
Security Fix(es):
* sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313)
Bug Fix(es) and Enhancement(s):
* sg_inq output conformance for SCSI name string and ATA fields [rhel-10.2.z] (JIRA:Rocky Linux-188123)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | sg3_utils | 0:1.48-7.el10_2.1 |
Vulnerabilities 1
-
High 7.6
Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can in…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2502845