SB2024013153 - SUSE update for slurm

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024013153

SB2024013153 - SUSE update for slurm

Published: January 31, 2024

Security Bulletin ID SB2024013153
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Medium 40% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CVE-ID: CVE-2023-49933)

CWE-ID: CWE-924 - Improper Enforcement of Message Integrity During Transmission in a Communication Channel

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper integrity check. A remote attacker can perform MitM attack and modify RPC traffic.


2) Insufficient Session Expiration (CVE-ID: CVE-2023-49935)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient session expiration issue. A remote non-authenticated attacker can reuse root-level authentication tokens during interaction with the slurmd process.


3) NULL pointer dereference (CVE-ID: CVE-2023-49936)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can send specially crafted data to the application and perform a denial of service (DoS) attack.


4) Double Free (CVE-ID: CVE-2023-49937)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can send specially crafted data to the application, trigger double free error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


5) Improper access control (CVE-ID: CVE-2023-49938)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can modify extended group list that is used with the sbcast subsystem, and open files with an unauthorized set of extended groups


Remediation

Install update from vendor's website.

References