CVE-2021-43337

Vulnerability

SchedMD Slurm versions 21.08.0 through 21.08.3 are affected by an incorrect access control vulnerability in the SlurmDBD component when the AccountingStoreFlags=job_script and/or AccountingStoreFlags=job_env options are enabled. The vulnerability allows users to request job scripts and environment files that they should not have access to [1][3]. Only the 21.08 release series is affected; Slurm 20.11 and older releases are not vulnerable [3].

Exploitation

An attacker must be a legitimate user of a Slurm cluster that has enabled the AccountingStoreFlags=job_script and/or job_env options. The attacker can then make requests to SlurmDBD to retrieve job scripts and environment files belonging to other users, without needing administrative privileges or being an account coordinator [3]. The exact steps are not detailed in the available references, but the incorrect access control rules allow the attacker to bypass intended restrictions.

Impact

Successful exploitation allows an authenticated user to obtain sensitive information from other users' jobs, specifically job scripts and environment files. This can leak confidential data such as embedded passwords, proprietary algorithms, or other sensitive configurations. The attacker gains unauthorized read access to data that should be restricted to administrator privileges, account coordinators, or the submitting user themselves [3].

Mitigation

The vulnerability is fixed in Slurm version 21.08.4, released on November 16, 2021 [1][3]. Sites using the affected AccountingStoreFlags options should upgrade to 21.08.4 or later. SchedMD customers were notified on November 2, 2021, and could obtain a fix on request prior to the public release [3]. No workarounds are mentioned in the available references; disabling the AccountingStoreFlags=job_script and job_env options would prevent exposure but may be required for certain site needs. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.