{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/sg3_utils/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.6,"id":"CVE-2026-16313"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["sg3_utils"],"_cs_severities":["high"],"_cs_tags":["linux","vulnerability","privilege-escalation","arbitrary-command-execution"],"_cs_type":"advisory","_cs_vendors":["Red Hat"],"content_html":"\u003cp\u003eA significant vulnerability, identified as CVE-2026-16313, has been discovered in the \u003ccode\u003esg3_utils\u003c/code\u003e package, specifically affecting the \u003ccode\u003esg_inq\u003c/code\u003e command when used with the \u003ccode\u003e--export\u003c/code\u003e option. This flaw impacts Red Hat Enterprise Linux 7, 8, 9, and 10. The \u003ccode\u003esg_inq\u003c/code\u003e command fails to sanitize control characters, such as newlines, present in SCSI device name string fields. An attacker can exploit this by crafting a malicious SCSI device with a name string containing newline characters and arbitrary \u003ccode\u003eudev\u003c/code\u003e properties. When this device is connected to a vulnerable system and the \u003ccode\u003esg_inq --export\u003c/code\u003e command is executed against it, the unsanitized output can inject malicious configurations into the \u003ccode\u003eudev\u003c/code\u003e device database. Subsequently, upon disconnection of the crafted SCSI device, these injected \u003ccode\u003eudev\u003c/code\u003e rules can trigger arbitrary command execution with root privileges, posing a critical risk to system integrity and data confidentiality.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker prepares a physical or virtual SCSI device, embedding malicious \u003ccode\u003eudev\u003c/code\u003e properties and newline characters within its device identification name string.\u003c/li\u003e\n\u003cli\u003eThe attacker connects the specially crafted SCSI device to a vulnerable Linux system, potentially via physical access or by compromising a virtual machine host to attach the device.\u003c/li\u003e\n\u003cli\u003eA user or an automated system with appropriate permissions executes the \u003ccode\u003esg_inq\u003c/code\u003e command with the \u003ccode\u003e--export\u003c/code\u003e option, targeting the crafted SCSI device.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003esg_inq\u003c/code\u003e utility queries the device and retrieves its identification data, including the unsanitized malicious name string.\u003c/li\u003e\n\u003cli\u003eDue to the vulnerability (lack of sanitization), the newline characters and malicious \u003ccode\u003eudev\u003c/code\u003e properties from the device name are passed to the system's \u003ccode\u003eudev\u003c/code\u003e device database or related configuration files.\u003c/li\u003e\n\u003cli\u003eUpon the disconnection of the crafted SCSI device, the \u003ccode\u003eudev\u003c/code\u003e system processes the newly injected malicious rules.\u003c/li\u003e\n\u003cli\u003eThese malicious \u003ccode\u003eudev\u003c/code\u003e rules are then executed, leading to arbitrary command execution.\u003c/li\u003e\n\u003cli\u003eThe commands are executed with \u003ccode\u003eroot\u003c/code\u003e privileges, allowing the attacker to gain full control over the compromised system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-16313 leads to arbitrary command execution as \u003ccode\u003eroot\u003c/code\u003e on affected Linux systems. This grants the attacker complete control over the compromised system, enabling them to install backdoors, exfiltrate sensitive data, disrupt operations, or establish persistence. The widespread use of \u003ccode\u003esg3_utils\u003c/code\u003e in Linux environments means that many systems could be vulnerable if an attacker can present a crafted SCSI device and trigger the \u003ccode\u003esg_inq --export\u003c/code\u003e command, which is often used for device inventory or debugging. This vulnerability could be particularly dangerous in environments with untrusted hardware connections or shared virtualized infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-16313 by updating \u003ccode\u003esg3_utils\u003c/code\u003e packages to fixed versions immediately on all Red Hat Enterprise Linux 7, 8, 9, and 10 systems.\u003c/li\u003e\n\u003cli\u003eRestrict physical access to systems to prevent attackers from connecting crafted SCSI devices.\u003c/li\u003e\n\u003cli\u003eImplement strong access controls and monitoring around the \u003ccode\u003esg_inq\u003c/code\u003e command, especially when used with the \u003ccode\u003e--export\u003c/code\u003e option, to detect unusual or unauthorized execution.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive logging for \u003ccode\u003eudev\u003c/code\u003e activities to identify anomalous rule injections or command executions originating from \u003ccode\u003eudev\u003c/code\u003e events.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T17:17:47Z","date_published":"2026-07-28T17:17:47Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-16313-sg3-utils/","summary":"A vulnerability, CVE-2026-16313, exists in the `sg_inq` command of `sg3_utils` on Red Hat Enterprise Linux systems, allowing an attacker who can present a specially crafted SCSI device to inject arbitrary properties into the `udev` device database by embedding a newline character in the device's name string, leading to arbitrary command execution as root when the device is disconnected.","title":"CVE-2026-16313: sg3_utils Vulnerability Allows Root Command Execution via Crafted SCSI Device","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-16313-sg3-utils/"}],"language":"en","title":"CraftedSignal Threat Feed - Sg3_utils","version":"https://jsonfeed.org/version/1.1"}