CVE-2021-31215

CVE-2021-31215 affects SchedMD Slurm. Affected: Slurm before 20.02.7 and 20.03.x through 20.11.x before 20.11.7. Root cause: environment mishandling when using PrologSlurmctld or EpilogSlurmctld scripts, enabling remote code execution as SlurmUser. Implication: remote code execution could be perf...

CVE-2020-27745

CVE-2020-27745 is a Slurm RPC Buffer Overflow in the PMIx MPI plugin. Connected advisories confirm the issue affects Slurm (Slurm-llnl) and dataset entries reference Ubuntu/Debian mitigations. Debian DLA-2886-1 fixes this CVE (and others) by upgrading slurm-llnl to 16.05.9-1+deb9u5; Ubuntu USN-47...

CVE-2020-27746

CVE-2020-27746 affects Slurm before 19.05.8 and 20.x before 20.02.6, where a race condition in reading /proc X11 magic cookies via xauth can expose sensitive information to an unauthorized actor. The issue is tied to a race in the read path of /proc, enabling potential leakage of X authentication...

CVE-2019-12838

CVE-2019-12838 affects SchedMD Slurm: SQL Injection in the accounting storage path. Public advisories affirm vulnerable releases include Slurm 17.11.x, 18.08.0–18.08.7, and 19.05.0. Debian and SUSE/Nessus/OpenVAS entries confirm available patches: Debian DLA-2143 (for Jessie) fixes via slurm-llnl...

CVE-2020-12693

CVE-2020-12693 affects Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3. In the scenario where Message Aggregation is enabled, a race condition can allow an authentication bypass through an Alternate Path or Channel and enable a user to launch a process as an arbitrary user. The connected ...

CVE-2019-19728

CVE-2019-19728 affects Slurm (SchedMD Slurm, slurm-llnl) where versions before 18.08.9 and 19.x before 19.05.5 allow a user’s srun --uid to execute with incorrect privileges, enabling privilege escalation. The vulnerability stems from improper privilege handling in srun when using the --uid optio...

CVE-2019-19727

CVE-2019-19727 affects SchedMD Slurm (before 18.08.9 and 19.x before 19.05.5) due to weak permissions on slurmdbd.conf. Exploitation could arise from local access to read/write the Slurm database daemon configuration, potentially exposing sensitive data or enabling unauthorized changes. The conne...

CVE-2022-29501

CVE-2022-29501 affects SchedMD Slurm 21.08.x through 20.11.x. Root cause: Incorrect Access Control allowing an unprivileged user to exploit PMI2/PMIx RPC handling to perform privilege escalation and potentially code execution. Exploitation details are not provided in the supplied documents. Confi...

CVE-2019-6438

CVE-2019-6438 is a Slurm vulnerability affecting 32-bit systems with Slurm 17.11.x and 18.x prior to 18.08.5, where 32-bit handling is mishandled. Connected advisories (USN-4781-1/2, SUSE/SLE, openVAS) confirm this CVE as part of multiple Slurm issues and document mitigations via updates to 18.08...

CVE-2022-29500

The CVE-2022-29500 family affects SchedMD Slurm 21.08.x through 20.11.x, with root cause identified as Incorrect Access Control that leads to Information Disclosure. Related CVEs (CVE-2022-29501 and CVE-2022-29502) involve escalation of privileges and potential data exposure or code execution via...

CVE-2023-41914

CVE-2023-41914 affects SchedMD Slurm 23.02.x (before 23.02.6) and 22.05.x (before 22.05.10), allowing filesystem race conditions to gain ownership, overwrite, or delete files. Multiple connected sources confirm the vulnerable components and fixed versions: upgrade to 23.02.6+ or 22.05.10+ (as app...

CVE-2022-29502

CVE-2022-29502 affects SchedMD Slurm 21.08.x through 20.11.x. The issue stems from an improper access-control check due to flawed validation logic in the srun client when processing input/output, which could allow an unprivileged user to escalate privileges or intercept I/O. Public references in ...

CVE-2023-49933

CVE-2023-49933 affects SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. The vulnerability is described as Improper Enforcement of Message Integrity During Transmission in a communication channel, allowing an attacker to modify RPC traffic in a way that bypasses message hash checks. Affected versions ...

CVE-2018-7033

CVE-2018-7033 affects Slurm/SlurmDBD: SQL injection in SlurmDBD is possible on Slurm versions before 17.02.10 and 17.11.x before 17.11.5. Public records reference CVE-2018-7033 across multiple advisories. Remediation per the connected sources is to upgrade Slurm/SlurmDBD to a version where the is...

CVE-2023-49937

CVE-2023-49937 affects SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. The issue is a double free that can cause a denial of service and possibly allow arbitrary code execution. Fixed versions are 22.05.11, 23.02.7, and 23.11.1. No exploitation details are provided in the documents. Upgrade affected...

CVE-2018-10995

CVE-2018-10995 affects Slurm where user_name and gid fields are mishandled in versions before 17.02.11 and 17.1x.y before 17.11.7. This issue was fixed in 17.11.7 (and corresponding upstream advisories across distributions). Connected notes show multiple advisories (USN/opensuse/SUSE SU-2020/2021...

CVE-2023-49935

CVE-2023-49935 affects SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. The root cause is a slurmd Message Integrity Bypass that lets an attacker reuse root-level MUNGE tokens during interaction with slurmd, bypassing RPC message hashes protecting against credential reuse. Fixed versions are 23.02.7 ...

CVE-2023-49936

CVE-2023-49936 affects SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. The issue is a NULL pointer dereference that leads to denial of service. Fixed versions are Slurm 22.05.11, 23.02.7, and 23.11.1. Multiple connected entries corroborate the vulnerability in Slurm and note the lack of public explo...

CVE-2016-10030

CVE-2016-10030 affects Slurm: the Prolog failure handling in slurmd/req.c can let a user influence an arbitrary file if they can cause or anticipate a Prolog script failure on a compute node. Affected versions span Slurm up to present in 0.6.0 onwards, with fixed ranges listed as: before 15.08.13...

CVE-2021-43337

CVE-2021-43337 affects Slurm 21.08.* prior to 21.08.4. The issue is an Incorrect Access Control in SlurmDBD when AccountingStoreFlags=job_script and/or job_env is used, which may allow a user to request job scripts or environment files they should not access. The 21.08.4 release (and later) fixes...

CVE-2024-48936

Summary: CVE-2024-48936 affects SchedMD Slurm prior to 24.05.4. A mis-implementation in authentication handling in the stepmgr could allow an attacker to run processes under other users’ jobs, limited to jobs explicitly using --stepmgr or systems with stepmgr globally enabled via SlurmctldParamet...

CVE-2023-49938

The CVE-2023-49938 issue affects SchedMD Slurm 22.05.x and 23.02.x. Root cause: Incorrect Access Control allowing an attacker to modify their extended group list used by the sbcast subsystem, enabling access to files with an unauthorized extended group set. Impact notes indicate high confidential...

CVE-2017-15566

In Slurm, CVE-2017-15566 is caused by insecure handling of SPANK environment variables, enabling local privilege escalation to root during Prolog or Epilog. Affected releases include Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2. The root cause is improper SPANK env va...

CVE-2023-49934

CVE-2023-49934 concerns Slurm 23.11.x where an SQL injection against the SlurmDBD database is possible. The issue affects SlurmDBD processing and is mitigated by upgrading to Slurm 23.11.1, which contains the fix. The NVD metrics indicate a critical impact (CVSS v3.1: CVSS:3.1, AV:N/AC:L/PR:N/UI:...