UbuntuUpdates.org

Package "sg3-utils-udev"

Name: sg3-utils-udev

Description:

utilities for devices using the SCSI command set (udev rules)
Latest version: 1.46-1ubuntu0.22.04.2
Release: jammy (22.04)
Level: updates
Repository: main
Head package: sg3-utils
Homepage: http://sg.danny.cz/sg/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "sg3-utils-udev"

All arch deb package
APT INSTALL

Other versions of "sg3-utils-udev" in Jammy

Repository Area Version
base main 1.46-1build1
security main 1.46-1ubuntu0.22.04.2

Changelog

Version: 1.46-1ubuntu0.22.04.2 2026-10-07 15:37:37 UTC

sg3-utils (1.46-1ubuntu0.22.04.2) jammy-security; urgency=medium

  * SECURITY UPDATE: command injection via udev property injection
    - debian/patches/CVE-2026-16313.patch: apply udev-conforming character
      encoding to the VPD 0x83 SCSI name string and T10 vendor ID ATA
      subfield output of sg_inq --export, so a crafted SCSI device cannot
      inject udev properties and execute commands as root (fix released
      upstream in sg3_utils 1.49).
    - debian/patches/CVE-2026-16313_2.patch: avoid including 0-bytes in SCSI
      name strings (upstream follow-up fix).
    - CVE-2026-16313

 -- Allen Huang Thu, 01 Oct 2026 14:12:16 +0100
Source diff to previous version
CVE-2026-16313 A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing contr

Version: 1.46-1ubuntu0.22.04.1 2023-10-11 22:06:52 UTC

  sg3-utils (1.46-1ubuntu0.22.04.1) jammy; urgency=medium

  * d/p/0002-Fix-crash-with-rescan-scsi-bus.sh-r.patch: do not allow
    rescan-scsi-bus.sh to remove device (LP: #1976228).

 -- Lucas Kanashiro <email address hidden> Wed, 22 Mar 2023 11:57:45 -0300
1976228 [Ubuntu 22.04 LTS]The host OS becomes read-only after the 'rescan-scsi-bus.sh -r' command is executed


About   -   Send Feedback to @ubuntu_updates