Improper access control in Slurm - CVE-2022-29502

Vulnerability identifier: #VU62863

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-29502

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the I/O key validation logic in the srun client command. A remote attacker can bypass implemented security restrictions and gain elevated privileges on the system.

Slurm
Ubuntu
Fedora
libpmi0 (Ubuntu package)
libslurm34 (Ubuntu package)
slurmrestd (Ubuntu package)
slurmdbd (Ubuntu package)
slurmd (Ubuntu package)
slurmctld (Ubuntu package)
slurm-wlm-basic-plugins (Ubuntu package)
slurm-wlm (Ubuntu package)
slurm-client (Ubuntu package)
libslurmdb-perl (Ubuntu package)
libslurm37 (Ubuntu package)
libslurm-perl (Ubuntu package)
libpmi2-0 (Ubuntu package)
libpam-slurm (Ubuntu package)
slurm

Install update from vendor's website.

Slurm - addressed in versions 20.11.9, 21.08.8
libpmi0 (Ubuntu package) - update to Ubuntu Pro
libslurm34 (Ubuntu package) - update to Ubuntu Pro
slurmrestd (Ubuntu package) - update to Ubuntu Pro
slurmdbd (Ubuntu package) - update to Ubuntu Pro
slurmd (Ubuntu package) - update to Ubuntu Pro
slurmctld (Ubuntu package) - update to Ubuntu Pro
slurm-wlm-basic-plugins (Ubuntu package) - update to Ubuntu Pro
slurm-wlm (Ubuntu package) - update to Ubuntu Pro
slurm-client (Ubuntu package) - update to Ubuntu Pro
libslurmdb-perl (Ubuntu package) - update to Ubuntu Pro
libslurm37 (Ubuntu package) - update to Ubuntu Pro
libslurm-perl (Ubuntu package) - update to Ubuntu Pro
libpmi2-0 (Ubuntu package) - update to Ubuntu Pro
libpam-slurm (Ubuntu package) - update to Ubuntu Pro
slurm - addressed in versions 21.08.8-1.fc37, 21.08.8-2.fc34, 21.08.8-2.fc35, 21.08.8-2.fc36

• https://lists.schedmd.com/pipermail/slurm-announce/
• https://www.schedmd.com/news.php
• https://www.schedmd.com/news.php?id=260

• Multiple vulnerabilities in SchedMD Slurm
• Ubuntu update for slurm-llnl
• Fedora 37 update for slurm
• Fedora 35 update for slurm
• Fedora 34 update for slurm
• Fedora 36 update for slurm