SchedMD Slurm up to 23.11.1 stepmgr improper authorization

Summaryinfo

A vulnerability categorized as critical has been discovered in SchedMD Slurm. Affected by this vulnerability is an unknown functionality of the component stepmgr. Such manipulation leads to improper authorization. This vulnerability is documented as CVE-2024-48936. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in SchedMD Slurm. It has been rated as critical. Affected by this issue is an unknown functionality of the component stepmgr. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via SlurmctldParameters=enable_stepmgr in their configuration.

The advisory is shared for download at schedmd.com. This vulnerability is handled as CVE-2024-48936 since 10/09/2024. The exploitation is known to be easy. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1548.002.

The vulnerability scanner Nessus provides a plugin with the ID 216737 (SUSE SLES12 : Feature update for slurm and pdsh (SUSE-SU-SUSE-FU-2025:0661-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 24.05.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (216737). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• SchedMD

Name

• Slurm

Version

• 16.05.11
• 17.02.8
• 17.02.9
• 17.02.10
• 17.02.11
• 17.11
• 17.11.0rc1
• 17.11.0rc2
• 17.11.4
• 17.11.5
• 17.11.6
• 17.11.7
• 17.11.13
• 18.08.0
• 18.08.1
• 18.08.2
• 18.08.3
• 18.08.4
• 18.08.5
• 18.08.6
• 18.08.7
• 18.08.9
• 19.05.0
• 19.05.4
• 19.05.5
• 20.02.7
• 20.11.6
• 20.11.7
• 21.08.4
• 22.05.11
• 23.02.6
• 23.02.7
• 23.11.0
• 23.11.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion