CVE-2023-49938

Vulnerability

An issue was discovered in SchedMD Slurm versions 22.05.x and 23.02.x [1]. The vulnerability resides in incorrect access control within the sbcast subsystem, allowing an attacker to modify their extended group list [1]. This manipulation causes file operations to be performed with an unauthorized set of extended groups [1]. The affected versions are 22.05.x (prior to 22.05.11) and 23.02.x (prior to 23.02.7) [1].

Exploitation

An attacker must have the ability to modify their own extended group list within the Slurm environment [1]. The attacker then uses this modified list when interacting with the sbcast subsystem, which opens files using the attacker-controlled extended group list rather than the correct set [1]. No authentication bypass or network position exploitation is required beyond standard user access.

Impact

A successful attack allows the attacker to open files with an unauthorized set of extended groups [1]. This can lead to unauthorized access to files that should be restricted, potentially resulting in information disclosure or unauthorized file operations [1]. The exact impact depends on the specific extended group memberships an attacker can claim.

Mitigation

The fixed versions are Slurm 22.05.11 and 23.02.7, released on December 13, 2023 [1][4]. SchedMD recommends upgrading to the patched versions and restarting the affected daemons [1]. No workarounds are available; patching is the only mitigation [1].