VYPR
← All advisories
Unrated severityNVD Advisory· Published Jan 13, 2020· Updated Aug 5, 2024

CVE-2019-19728

CVE-2019-19728

Description

A race condition in Slurm's srun --uid can cause tasks to run as root instead of the specified user, allowing privilege escalation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A race condition in Slurm's srun --uid can cause tasks to run as root instead of the specified user, allowing privilege escalation.

Vulnerability

SchedMD Slurm versions before 18.08.9 and 19.x before 19.05.5 contain a race condition in the srun --uid command. The --uid option is intended to run a task as a specific user, but due to a race condition between successive lookup calls within the srun client, the process may not drop privileges correctly and instead run tasks as root [1].

Exploitation

An attacker must be root to use the srun --uid option. By exploiting the race window between user lookup calls, the attacker can cause srun to launch tasks with root privileges despite the --uid specification [1].

Impact

Successful exploitation allows an attacker to execute tasks as root instead of the intended user, leading to privilege escalation within the Slurm cluster. The attacker can gain full control over jobs and potentially the underlying system [1].

Mitigation

The issue is fixed in Slurm versions 18.08.9 and 19.05.5 [1]. Distributions such as SUSE and openSUSE have released patches (e.g., SUSE-SU-2020:0110-1 and openSUSE-SU-2020:0085-1) [1]. SchedMD recommends avoiding the use of srun --uid as it does not load the target user's environment and may be removed in a future release [1].

References
  1. [HPC,SLURM,CVE-2019-19728] Due to Race srun may run as User root

AI Insight generated on May 26, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

16

Patches

0

No patches discovered yet.

Vulnerability mechanics

Root cause

"A race condition in the srun client allows tasks to be launched as root instead of the intended user."

Attack vector

The vulnerability is triggered when the root user executes `srun --uid` with successive lookup calls. A race condition between these calls can cause the `srun` command to fail to drop into the correct user account. Instead, it prints a warning message but proceeds to launch the tasks as the root user [ref_id=1]. This option is only available to the root user and does not load the target user's environment, instead exporting the root user's environment [ref_id=1].

Affected code

The vulnerability lies within the `srun` client command, specifically related to the handling of the `--uid` option. The issue arises due to a race condition between successive lookup calls within this client command [ref_id=1].

What the fix does

The advisory indicates that SchedMD does not recommend the use of the `srun --uid` option and may remove it in a future release [ref_id=1]. Updates were released for SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 and SUSE Linux Enterprise Module for HPC 15-SP1, including a fix for this vulnerability [ref_id=1].

Preconditions

  • authThe `srun --uid` option is only available to the root user.

Generated on Jun 2, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.