Slurm (X11 forwarding, xauth magic-cookie setup): Slurm shells out to xauth to install a user's X11 magic cookie, and

Impact

Slurm shells out to xauth to install a user's X11 magic cookie, and there is a window where the cookie is visible under /proc. A co-tenant polling /proc on the same node steals the cookie and attaches to that user's X11 session - keystrokes, screen contents, and the ability to inject input.

Who can reach it

A co-tenant with a job or shell on the same compute node as a victim who submitted with --x11. Only jobs that requested X11 forwarding are exposed.

What to do

Upgrade to Slurm 19.05.8 or 20.02.6 and restart slurmd. If you cannot upgrade, disable X11 forwarding (PrologFlags without X11) - on a GPU training cluster X11 forwarding is almost never load-bearing and turning it off is cheap.

References