An update for sg3_utils is now available for openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3244 Final 1.0 1.0 2026-08-07 Initial 2026-08-07 2026-08-07 openEuler SA Tool V1.0 2026-08-07 sg3_utils security update An update for sg3_utils is now available for openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1 The sg3_utils package contains utilities that send SCSI commands to devices. As well as devices on transports traditionally associated with SCSI (e.g. Fibre Channel (FCP), Serial Attached SCSI (SAS) and the SCSI Parallel Interface(SPI)) many other devices use SCSI command sets. ATAPI cd/dvd drives and SATA disks that connect via a translation layer or a bridge device are examples of devices that use SCSI command sets. Security Fix(es): A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected.(CVE-2026-16313) An update for sg3_utils is now available for openEuler-24.03-LTS-SP3,openEuler-24.03-LTS-SP4,openEuler-20.03-LTS-SP4,openEuler-22.03-LTS-SP4,openEuler-24.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High sg3_utils https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3244 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16313 https://nvd.nist.gov/vuln/detail/CVE-2026-16313 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 sg3_utils-1.48-4.oe2403sp3.src.rpm sg3_utils-1.48-4.oe2403sp4.src.rpm sg3_utils-1.45-14.oe2003sp4.src.rpm sg3_utils-1.46-10.oe2203sp4.src.rpm sg3_utils-1.48-4.oe2403sp1.src.rpm sg3_utils-1.48-4.oe2403sp3.x86_64.rpm sg3_utils-debuginfo-1.48-4.oe2403sp3.x86_64.rpm sg3_utils-debugsource-1.48-4.oe2403sp3.x86_64.rpm sg3_utils-devel-1.48-4.oe2403sp3.x86_64.rpm sg3_utils-help-1.48-4.oe2403sp3.x86_64.rpm sg3_utils-1.48-4.oe2403sp4.x86_64.rpm sg3_utils-debuginfo-1.48-4.oe2403sp4.x86_64.rpm sg3_utils-debugsource-1.48-4.oe2403sp4.x86_64.rpm sg3_utils-devel-1.48-4.oe2403sp4.x86_64.rpm sg3_utils-help-1.48-4.oe2403sp4.x86_64.rpm sg3_utils-1.45-14.oe2003sp4.x86_64.rpm sg3_utils-debuginfo-1.45-14.oe2003sp4.x86_64.rpm sg3_utils-debugsource-1.45-14.oe2003sp4.x86_64.rpm sg3_utils-devel-1.45-14.oe2003sp4.x86_64.rpm sg3_utils-help-1.45-14.oe2003sp4.x86_64.rpm sg3_utils-1.46-10.oe2203sp4.x86_64.rpm sg3_utils-debuginfo-1.46-10.oe2203sp4.x86_64.rpm sg3_utils-debugsource-1.46-10.oe2203sp4.x86_64.rpm sg3_utils-devel-1.46-10.oe2203sp4.x86_64.rpm sg3_utils-help-1.46-10.oe2203sp4.x86_64.rpm sg3_utils-1.48-4.oe2403sp1.x86_64.rpm sg3_utils-debuginfo-1.48-4.oe2403sp1.x86_64.rpm sg3_utils-debugsource-1.48-4.oe2403sp1.x86_64.rpm sg3_utils-devel-1.48-4.oe2403sp1.x86_64.rpm sg3_utils-help-1.48-4.oe2403sp1.x86_64.rpm sg3_utils-1.48-4.oe2403sp3.aarch64.rpm sg3_utils-debuginfo-1.48-4.oe2403sp3.aarch64.rpm sg3_utils-debugsource-1.48-4.oe2403sp3.aarch64.rpm sg3_utils-devel-1.48-4.oe2403sp3.aarch64.rpm sg3_utils-help-1.48-4.oe2403sp3.aarch64.rpm sg3_utils-1.48-4.oe2403sp4.aarch64.rpm sg3_utils-debuginfo-1.48-4.oe2403sp4.aarch64.rpm sg3_utils-debugsource-1.48-4.oe2403sp4.aarch64.rpm sg3_utils-devel-1.48-4.oe2403sp4.aarch64.rpm sg3_utils-help-1.48-4.oe2403sp4.aarch64.rpm sg3_utils-1.45-14.oe2003sp4.aarch64.rpm sg3_utils-debuginfo-1.45-14.oe2003sp4.aarch64.rpm sg3_utils-debugsource-1.45-14.oe2003sp4.aarch64.rpm sg3_utils-devel-1.45-14.oe2003sp4.aarch64.rpm sg3_utils-help-1.45-14.oe2003sp4.aarch64.rpm sg3_utils-1.46-10.oe2203sp4.aarch64.rpm sg3_utils-debuginfo-1.46-10.oe2203sp4.aarch64.rpm sg3_utils-debugsource-1.46-10.oe2203sp4.aarch64.rpm sg3_utils-devel-1.46-10.oe2203sp4.aarch64.rpm sg3_utils-help-1.46-10.oe2203sp4.aarch64.rpm sg3_utils-1.48-4.oe2403sp1.aarch64.rpm sg3_utils-debuginfo-1.48-4.oe2403sp1.aarch64.rpm sg3_utils-debugsource-1.48-4.oe2403sp1.aarch64.rpm sg3_utils-devel-1.48-4.oe2403sp1.aarch64.rpm sg3_utils-help-1.48-4.oe2403sp1.aarch64.rpm A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected. 2026-08-07 CVE-2026-16313 openEuler-24.03-LTS-SP3 openEuler-24.03-LTS-SP4 openEuler-20.03-LTS-SP4 openEuler-22.03-LTS-SP4 openEuler-24.03-LTS-SP1 High 7.6 AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H sg3_utils security update 2026-08-07 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3244