A command injection vulnerability exists in sg3_utils versions 1.34 through 1.48 in the export_dev_ids() function of the sg_inq command. When processing SCSI device identification data from VPD page 0x83, the SCSI name string and ATA vendor-ID subfield are output without sanitizing embedded control characters such as newline characters. An attacker with physical access can present a crafted SCSI or USB device embedding a newline character in these fields, causing sg_inq --export to split its udev KEY=VALUE output into multiple lines and inject arbitrary udev properties, including REMOVE_CMD. Systems with default udev rules invoking sg_inq --export and acting on REMOVE_CMD upon device removal can be exploited to execute arbitrary commands as root simply by disconnecting the crafted device. The vulnerability has a CVSS 3.1 score of 7.6 (high) with a physical attack vector, low complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability. Red Hat has not yet included the upstream fix in any tagged sg3_utils release but has issued advisories and patches for Red Hat Enterprise Linux 9. Mitigations include removing or commenting out the REMOVE_CMD rule in udev and disabling the udev rule invoking sg_inq --export if automatic SCSI device identification is not needed.

An attacker with physical access to a USB or SCSI port can connect a specially crafted device that injects arbitrary properties into the udev device database, leading to arbitrary command execution as root when the device is disconnected. This compromises system confidentiality, integrity, and availability with full root privileges. The attack requires physical access but no prior privileges or user interaction.

Red Hat has released security updates addressing this vulnerability for Red Hat Enterprise Linux 9. Users should apply these updates promptly. If patching is not immediately possible, mitigations include removing or commenting out the REMOVE_CMD rule from the 50-udev-default.rules file to prevent command execution on device removal, or disabling the udev rule that invokes sg_inq --export if automatic SCSI device identification is not required. These mitigations reduce the risk of exploitation until patches can be applied.