CVE-2019-6438

Vulnerability

SchedMD Slurm versions before 17.11.13 and 18.x before 18.08.5 mishandle memory operations on 32-bit systems [1][2]. The vulnerability stems from improper handling of 32-bit arithmetic or pointer operations, which can result in memory corruption or buffer overflow. The issue affects only 32-bit builds; the overwhelming majority of installations running on 64-bit systems are not affected [2].

Exploitation

An attacker would need to interact with a 32-bit Slurm installation. The exact exploitation prerequisites are not fully detailed in the available references, but the vulnerability allows for memory mishandling that could be triggered remotely or by a local user with access to Slurm commands. The official announcement indicates that the fix addresses a security vulnerability on 32-bit systems [2].

Impact

Successful exploitation could lead to unpredictable behavior, including potential denial of service or arbitrary code execution, depending on the nature of the memory corruption. The vulnerability may allow an attacker to gain elevated privileges or crash the system, but the exact impact is not explicitly described beyond the general mishandling on 32-bit systems [1][2].

Mitigation

SchedMD has released fixed versions 17.11.13 and 18.08.5 [2]. Administrators running Slurm on 32-bit hardware should upgrade to these versions. For 64-bit builds, no action is required as they are not vulnerable. Past unsupported versions also suffer from similar issues, and upgrading to a supported fixed release is the only resolution [2]. No workarounds are documented.