The sg3_utils utility contains a flaw in the sg_inq command when run with the --export option. Outputting device identification data without sanitizing control characters in SCSI name fields allows a newline embedded in a device‑supplied name string to inject arbitrary properties into the udev database. This injection gives an attacker who can present a crafted SCSI device the ability to execute arbitrary commands as root upon device disconnection, effectively providing root command execution.

Red Hat Enterprise Linux 10, 6, 7, 8, 9 and Red Hat OpenShift Container Platform 4 systems that include sg3_utils. Any installation of the default sg3_utils package on these platforms is vulnerable, and the exposed file is /etc/udev/rules.d/50-udev-default.rules.

The vulnerability receives a CVSS base score of 7.6, indicating a high severity. The EPSS score is below 1 %, suggesting that exploitation is unlikely but still possible. The issue is not yet listed in the CISA KEV catalog. The likely attack vector involves an attacker who can place a malicious or tampered SCSI device on the system, optionally disconnecting it to trigger command execution. In the absence of a credible exploit in the wild, the risk is mainly mitigated by policy controls, but the high severity demands remediation.