Insufficient Session Expiration in Slurm - CVE-2023-49935

Vulnerability identifier: #VU84786

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-49935

CWE-ID: CWE-613

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient session expiration issue. A remote non-authenticated attacker can reuse root-level authentication tokens during interaction with the slurmd process.

Slurm
Gentoo Linux
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Micro
HPC Module
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Package Hub 15
openSUSE Leap
Fedora
sys-cluster/slurm
slurm
slurm_23_02-sql-debuginfo
slurm_23_02-munge
slurm_23_02-devel
libslurm39-debuginfo
libpmi0_23_02-debuginfo
slurm_23_02-pam_slurm
slurm_23_02-cray-debuginfo
slurm_23_02-lua-debuginfo
slurm_23_02-munge-debuginfo
slurm_23_02-sview-debuginfo
slurm_23_02-plugin-ext-sensors-rrd-debuginfo
slurm_23_02-plugin-ext-sensors-rrd
slurm_23_02-sview
slurm_23_02-auth-none
slurm_23_02-auth-none-debuginfo
slurm_23_02-node-debuginfo
slurm_23_02
slurm_23_02-pam_slurm-debuginfo
slurm_23_02-cray
libnss_slurm2_23_02-debuginfo
perl-slurm_23_02-debuginfo
slurm_23_02-config-man
slurm_23_02-config
slurm_23_02-webdoc
slurm_23_02-doc
slurm_23_02-node
perl-slurm_23_02
slurm_23_02-sql
slurm_23_02-lua
slurm_23_02-torque-debuginfo
libpmi0_23_02
slurm_23_02-slurmdbd-debuginfo
slurm_23_02-debugsource
slurm_23_02-torque
libslurm39
slurm_23_02-plugins-debuginfo
slurm_23_02-slurmdbd
slurm_23_02-plugins
libnss_slurm2_23_02
slurm_23_02-debuginfo
slurm_23_02-rest
slurm_23_02-rest-debuginfo
slurm_23_02-openlava
slurm_23_02-sjstat
slurm_23_02-seff
slurm_23_02-testsuite
slurm_23_02-hdf5-debuginfo
slurm_23_02-hdf5
slurm-plugin-ext-sensors-rrd-debuginfo
libpmi0-debuginfo
slurm-sview
slurm-debuginfo
slurm-node
slurm-devel
slurm-plugins-debuginfo
slurm-torque
libpmi0
slurm-auth-none-debuginfo
slurm-auth-none
perl-slurm-debuginfo
slurm-plugin-ext-sensors-rrd
slurm-torque-debuginfo
slurm-rest
slurm-slurmdbd-debuginfo
slurm-pam_slurm-debuginfo
slurm-cray
slurm-munge
slurm-sql-debuginfo
slurm-munge-debuginfo
slurm-plugins
slurm-slurmdbd
slurm-lua-debuginfo
slurm-config-man
slurm-doc
slurm-config
slurm-webdoc
slurm-hdf5
slurm-hdf5-debuginfo
slurm-seff
slurm-openlava
slurm-sjstat
slurm-testsuite
slurm-node-debuginfo
slurm-lua
slurm-debugsource
slurm-pam_slurm
perl-slurm
slurm-sview-debuginfo
slurm-rest-debuginfo
slurm-cray-debuginfo
libnss_slurm2-debuginfo
libnss_slurm2
slurm-sql

Install updates from vendor's website.

Slurm - addressed in versions 23.02.7.1, 23.11.1.1
sys-cluster/slurm - update to 22.05.3
slurm - addressed in versions 22.05.11-2.fc38, 22.05.11-2.fc39
slurm_23_02-sql-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-munge - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-devel - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
libslurm39-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1, 23.02.7-150500.5.15.1
libpmi0_23_02-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-pam_slurm - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-cray-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-lua-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-munge-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-sview-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-plugin-ext-sensors-rrd-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-plugin-ext-sensors-rrd - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-sview - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-auth-none - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-auth-none-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-node-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02 - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-pam_slurm-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-cray - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
libnss_slurm2_23_02-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
perl-slurm_23_02-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-config-man - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-config - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-webdoc - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-doc - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-node - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
perl-slurm_23_02 - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-sql - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-lua - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-torque-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
libpmi0_23_02 - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-slurmdbd-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-debugsource - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-torque - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
libslurm39 - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1, 23.02.7-150500.5.15.1
slurm_23_02-plugins-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-slurmdbd - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-plugins - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
libnss_slurm2_23_02 - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-debuginfo - addressed in versions 23.02.7-3.16.1, 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-rest - addressed in versions 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-rest-debuginfo - addressed in versions 23.02.7-150200.5.17.1, 23.02.7-150300.7.17.1
slurm_23_02-openlava - update to 23.02.7-150300.7.17.1
slurm_23_02-sjstat - update to 23.02.7-150300.7.17.1
slurm_23_02-seff - update to 23.02.7-150300.7.17.1
slurm_23_02-testsuite - update to 23.02.7-150300.7.17.1
slurm_23_02-hdf5-debuginfo - update to 23.02.7-150300.7.17.1
slurm_23_02-hdf5 - update to 23.02.7-150300.7.17.1
slurm-plugin-ext-sensors-rrd-debuginfo - update to 23.02.7-150500.5.15.1
libpmi0-debuginfo - update to 23.02.7-150500.5.15.1
slurm-sview - update to 23.02.7-150500.5.15.1
slurm-debuginfo - update to 23.02.7-150500.5.15.1
slurm - update to 23.02.7-150500.5.15.1
slurm-node - update to 23.02.7-150500.5.15.1
slurm-devel - update to 23.02.7-150500.5.15.1
slurm-plugins-debuginfo - update to 23.02.7-150500.5.15.1
slurm-torque - update to 23.02.7-150500.5.15.1
libpmi0 - update to 23.02.7-150500.5.15.1
slurm-auth-none-debuginfo - update to 23.02.7-150500.5.15.1
slurm-auth-none - update to 23.02.7-150500.5.15.1
perl-slurm-debuginfo - update to 23.02.7-150500.5.15.1
slurm-plugin-ext-sensors-rrd - update to 23.02.7-150500.5.15.1
slurm-torque-debuginfo - update to 23.02.7-150500.5.15.1
slurm-rest - update to 23.02.7-150500.5.15.1
slurm-slurmdbd-debuginfo - update to 23.02.7-150500.5.15.1
slurm-pam_slurm-debuginfo - update to 23.02.7-150500.5.15.1
slurm-cray - update to 23.02.7-150500.5.15.1
slurm-munge - update to 23.02.7-150500.5.15.1
slurm-sql-debuginfo - update to 23.02.7-150500.5.15.1
slurm-munge-debuginfo - update to 23.02.7-150500.5.15.1
slurm-plugins - update to 23.02.7-150500.5.15.1
slurm-slurmdbd - update to 23.02.7-150500.5.15.1
slurm-lua-debuginfo - update to 23.02.7-150500.5.15.1
slurm-config-man - update to 23.02.7-150500.5.15.1
slurm-doc - update to 23.02.7-150500.5.15.1
slurm-config - update to 23.02.7-150500.5.15.1
slurm-webdoc - update to 23.02.7-150500.5.15.1
slurm-hdf5 - update to 23.02.7-150500.5.15.1
slurm-hdf5-debuginfo - update to 23.02.7-150500.5.15.1
slurm-seff - update to 23.02.7-150500.5.15.1
slurm-openlava - update to 23.02.7-150500.5.15.1
slurm-sjstat - update to 23.02.7-150500.5.15.1
slurm-testsuite - update to 23.02.7-150500.5.15.1
slurm-node-debuginfo - update to 23.02.7-150500.5.15.1
slurm-lua - update to 23.02.7-150500.5.15.1
slurm-debugsource - update to 23.02.7-150500.5.15.1
slurm-pam_slurm - update to 23.02.7-150500.5.15.1
perl-slurm - update to 23.02.7-150500.5.15.1
slurm-sview-debuginfo - update to 23.02.7-150500.5.15.1
slurm-rest-debuginfo - update to 23.02.7-150500.5.15.1
slurm-cray-debuginfo - update to 23.02.7-150500.5.15.1
libnss_slurm2-debuginfo - update to 23.02.7-150500.5.15.1
libnss_slurm2 - update to 23.02.7-150500.5.15.1
slurm-sql - update to 23.02.7-150500.5.15.1

• https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html

• Multiple vulnerabilities in SchedMD Slurm
• Fedora 39 update for slurm
• Fedora 38 update for slurm
• SUSE update for slurm_23_02
• SUSE update for slurm_23_02
• SUSE update for slurm
• SUSE update for slurm_23_02
• Gentoo update for Slurm