Database/Control plane, storage & DevOps
Slurm (slurmdbd accounting database daemon): SQL injection into SlurmDBD gives an attacker read and write control of
Impact
SQL injection into SlurmDBD gives an attacker read and write control of the cluster's accounting database - the record of which account owns which job, which associations exist, and what fairshare and QOS limits apply. Rewriting associations is how you grant yourself submission rights to another tenant's account, and the same database is what billing and chargeback are computed from.
Who can reach it
Anything that can send RPCs to the slurmdbd port. In most sites slurmdbd is reachable from the login nodes and from slurmctld, so a tenant with a shell on a login node is in position.
What to do
Upgrade Slurm to 17.02.10 or 17.11.5 and restart slurmdbd. slurmdbd can be restarted independently of slurmctld and running jobs survive it, so this does not need a maintenance window. Audit the assoc and user tables afterwards - the injection leaves no distinctive log line.
References
Related entries
- Kemp LoadMaster (LMOS): A flaw in session management lets a remote, unauthenticated attacker bypass the LoadMaster'sCVE-2018-9091 · Kemp LoadMaster (LMOS)Critical
- Slurm (slurmdbd, sacctmgr archive load): A second SQL injection path into SlurmDBD, this one through the 'sacctmgrCVE-2019-12838 · Slurm (slurmdbd, sacctmgr archive load)Critical
- HTCondor (condor_startd, condor_schedd, condor_shadow): One CVE covering four separate authentication failures theCVE-2019-18823 · HTCondor (condor_startd, condor_schedd, condor_shadow)Critical
- Lustre ptlrpc module (server-side client packet validation): A Lustre client can send a crafted RPC that overflows aCVE-2019-20427 · Lustre ptlrpc module (server-side client packet validation)Critical
- NetApp ONTAP Select Deploy administration utility (HTTP service): An unauthenticated attacker performs administrativeCVE-2019-5504 · NetApp ONTAP Select Deploy administration utility (HTTP service)Critical
- NetApp ONTAP Select Deploy administration utility (credential transport): Deploy sends its credentials in plaintext, soCVE-2019-5505 · NetApp ONTAP Select Deploy administration utility (credential transport)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.