Altair PBS Professional / OpenPBS (pbs_mom): Pbs_mom, the daemon that executes jobs on every compute node, accepts

Impact

Pbs_mom, the daemon that executes jobs on every compute node, accepts messages without authenticating them. Send it a message directly and you get code execution on that node with the daemon's privileges - which is how a tenant on one node reaches into the execution path of jobs belonging to everyone else on the cluster.

Who can reach it

Adjacent network - anything that can open a socket to pbs_mom on a compute node. On a flat cluster network that is every tenant with a running job.

What to do

Upgrade past PBS Professional 19.1.2 / the corresponding OpenPBS release. Until then, firewall the pbs_mom port so that only the pbs_server host can reach it - the daemon has no business accepting connections from compute peers. Rolling the pbs_mom binary requires draining each node.

References