Database/Container, Kubernetes & orchestration
Slurm: Environment mishandling in PrologSlurmctld/EpilogSlurmctld gives remote code execution as SlurmUser
CVSS 8.8CVE-2021-31215Container, Kubernetes & orchestrationcurated
Impact
Environment mishandling in PrologSlurmctld/EpilogSlurmctld gives remote code execution as SlurmUser
Who can reach it
Any user who can submit a job
What to do
Upgrade Slurm; audit prolog/epilog scripts
References
Related entries
- Slurm: Incorrect access control leading to information disclosure across users' jobsCVE-2022-29500 · SlurmHigh
- Slurm: Incorrect access control leading to privilege escalation and code executionCVE-2022-29501 · SlurmHigh
- Slurm: slurmd message-integrity bypass permits reuse of root-level authentication tokensCVE-2023-49935 · SlurmHigh
- Slurm: A user can modify their extended group list used by sbcast and open files with unauthorized permissionsCVE-2023-49938 · SlurmHigh
- Slurm: Race condition in message aggregation allows launching a process as another userCVE-2020-12693 · SlurmHigh
- Slurm: Improper message-integrity enforcement allows RPC traffic modificationCVE-2023-49933 · SlurmHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.