QSN-8874-1: sg3_utils vulnerability
2026-10-06

Summary:
sg3_utils could be made to run programs as an administrator if it received specially crafted input.

Details:
Shaomin Chen discovered that sg3_utils did not properly sanitize device
identification data. An attacker could possibly use this issue to
execute arbitrary commands.

Affected QuantaStor releases:
  6.9.1.001 jammy: libsgutils2-2 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.9.1.001 jammy: sg3-utils 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.9.1.001 jammy: sg3-utils-udev 1.46-1ubuntu0.22.04.2 (fixed in 1.46-1ubuntu0.22.04.2)
  6.9.0.464 jammy: libsgutils2-2 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.9.0.464 jammy: sg3-utils 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.9.0.464 jammy: sg3-utils-udev 1.46-1ubuntu0.22.04.2 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.6.015 jammy: libsgutils2-2 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.6.015 jammy: sg3-utils 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.6.015 jammy: sg3-utils-udev 1.46-1ubuntu0.22.04.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.5.018 jammy: libsgutils2-2 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.5.018 jammy: sg3-utils 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.5.018 jammy: sg3-utils-udev 1.46-1ubuntu0.22.04.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.4.038 jammy: libsgutils2-2 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.4.038 jammy: sg3-utils 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.4.038 jammy: sg3-utils-udev 1.46-1ubuntu0.22.04.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.3.018 jammy: libsgutils2-2 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.3.018 jammy: sg3-utils 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.3.018 jammy: sg3-utils-udev 1.46-1ubuntu0.22.04.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.2.002 jammy: libsgutils2-2 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.2.002 jammy: sg3-utils 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.2.002 jammy: sg3-utils-udev 1.46-1ubuntu0.22.04.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.1.007 jammy: libsgutils2-2 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.1.007 jammy: sg3-utils 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.1.007 jammy: sg3-utils-udev 1.46-1ubuntu0.22.04.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.0.205 jammy: libsgutils2-2 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.0.205 jammy: sg3-utils 1.47-0.1 (fixed in 1.46-1ubuntu0.22.04.2)
  6.8.0.205 jammy: sg3-utils-udev 1.46-1ubuntu0.22.04.1 (fixed in 1.46-1ubuntu0.22.04.2)

CVEs: CVE-2026-16313

References:
  https://ubuntu.com/security/notices/USN-8874-1