Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

sg3_utils v1.34 through v1.48 contains a command injection flaw in export_dev_ids() in src/sg_inq.c. The sg_inq --export command outputs SCSI device identification data from VPD page 0x83 in KEY=VALUE format for udev import. The SCSI name string field (designator type 8, line 2046) and the ATA subfield (line 1922) are printed with printf("%.*s") without sanitizing control characters. A newline embedded in a device-controlled name string splits a single property into two lines, allowing injection of arbitrary udev properties including REMOVE_CMD. Combined with the default udev rule in 50-udev-default.rules that executes REMOVE_CMD on device removal, this enables arbitrary root command execution when a crafted SCSI device is disconnected. CWE-93. Introduced in commit c410806c (2012-02-23). Fixed upstream in PR #83.