CVE-2023-41914

Vulnerability

A set of filesystem race conditions exist in SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 within the slurmd and slurmstepd processes. These race conditions can be exploited to allow a user to take ownership of an arbitrary file, overwrite an arbitrary file (with data not directly under their control), or delete all files and sub-directories of an arbitrary target directory on the compute node [1]. The vulnerabilities were discovered during an audit of Slurm's filesystem handling code [1].

Exploitation

An attacker requires unprivileged access to a Slurm compute node. The race conditions are triggered during normal file operations performed by slurmd and slurmstepd. Exploitation does not require special authentication beyond a standard user account on the system [1]. The specific sequence involves timing attacks against filesystem operations to win races before permissions or ownership checks complete [1].

Impact

Successful exploitation allows an unprivileged attacker to gain ownership of arbitrary files, overwrite arbitrary files (with limited control over the data written), or recursively delete all files and subdirectories of an arbitrary directory on the compute node. This can lead to privilege escalation, data corruption, or denial of service [1].

Mitigation

Fixed versions are 23.02.6 and 22.05.10, released on October 11, 2023 [1]. SchedMD only issues security fixes for the currently supported releases (23.02 and 22.05) and strongly discourages backporting to older, unsupported releases [1]. Sites should upgrade immediately. No workaround other than upgrading has been disclosed. The CVE is not listed on the CISA KEV as of this writing.