CVE-2020-27746

An unauthorized local user can exploit a TOCTOU (time-of-check, time-of-use) race condition in the read of `/proc` filesystem entries used by `xauth` for X11 magic cookies. By racing the read operation, the attacker can obtain the X11 magic cookie of another user's job, which can then be used to connect to that user's X11 display and capture keystrokes, screen contents, or inject input. The attack requires the attacker to have a local account on the cluster node and the ability to time the race window.

The advisory states that Slurm before 19.05.8 and 20.x before 20.02.6 exposes sensitive information because `xauth` for X11 magic cookies is affected by a race condition in a read operation on the `/proc` filesystem. The patch notes in [ref_id=1] mention a "rare potential race condition in x11 forwarding that could result in a double free" and a "potential glibc deadlock when tearing down the extern step when x11 forwarding is enabled," confirming the affected code path involves X11 forwarding and the handling of xauth cookies.

The advisory does not provide a specific patch diff, but the release notes in [ref_id=1] indicate that the fix addresses the race condition in the read operation on `/proc` used by `xauth` for X11 magic cookies. The fix likely serializes or locks the `/proc` read to prevent a concurrent attacker from intercepting the cookie during the time-of-check-to-time-of-use window. Later versions also fix a related double-free and a glibc deadlock in the X11 forwarding path, further hardening the cookie handling.