CVE-2022-29500

SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.

Incorrect Access Control that leads to Information Disclosure. (CVE-2022-29500) Incorrect Access Control that leads to Escalation of Privileges and code execution. (CVE-2022-29501)

These are all security issues fixed in the libnss_slurm2-21.08.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for pdsh, slurm_22_05 fixes the following issues:

Slurm was updated to 22.05.5

• Fixes a number of moderate severity issues, noteable are:

  • Load hash plugin at slurmstepd launch time to prevent issues loading the plugin at step completion if the Slurm installation is upgraded.
  • Update nvml plugin to match the unique id format for MIG devices in new Nvidia drivers.
  • Fix multi-node step launch failure when nodes in the controller aren't in natural order. This can happen with inconsistent node naming (such as node15 and node052) or with dynamic nodes which can register in any order.
  • job_container/tmpfs - cleanup containers even when the .ns file isn't mounted anymore.
  • Wait up to PrologEpilogTimeout before shutting down slurmd to allow prolog and epilog scripts to complete or timeout. Previously, slurmd waited 120 seconds before timing out and killing prolog and epilog scripts.

• Do not deduplicate files of testsuite Slurm configuration. This directory is supposed to be mounted over /etc/slurm therefore it must not contain softlinks to the files in this directory.

• Fix a potential security vulnerability in the test package (bsc#1201674, CVE-2022-31251).

• update to 22.05.2 with following fixes:

  • Fix regression which allowed the oversubscription of licenses.
  • Fix a segfault in slurmctld when requesting gres in job arrays.

• Allow log in as user 'slurm'. This allows admins to run certain priviledged commands more easily without becoming root.

update to 22.05.0 with following changes:

• Support for dynamic node addition and removal

• Support for native Linux cgroup v2 operation

• Newly added plugins to support HPE Slingshot 11 networks (switch/hpe_slingshot), and Intel Xe GPUs (gpu/oneapi)

• Added new acct_gather_interconnect/sysfs plugin to collect statistics from arbitrary network interfaces.

• Expanded and synced set of environment variables available in the Prolog/Epilog/PrologSlurmctld/EpilogSlurmctld scripts.

• New '--prefer' option to job submissions to allow for a 'soft constraint' request to influence node selection.

• Optional support for license planning in the backfill scheduler with 'bf_licenses' option in SchedulerParameters.

• Add a comment about the CommunicationParameters=block_null_hash option warning users who migrate - just in case.

• Update to 21.08.8 which fixes CVE-2022-29500 (bsc#1199278), CVE-2022-29501 (bsc#1199279), and CVE-2022-29502 (bsc#1199281).

• Added 'CommunicationParameters=block_null_hash' to slurm.conf, please add this parameter to existing configurations.

• Update to 21.08.7 with following changes:

  • openapi/v0.0.37 - correct calculation for bf_queue_len_mean in /diag.
  • Avoid shrinking a reservation when overlapping with downed nodes.
  • Only check TRES limits against current usage for TRES requested by the job.
  • Do not allocate shared gres (MPS) in whole-node allocations
  • Constrain slurmstepd to job/step cgroup like in previous versions of Slurm.
  • Fix warnings on 32-bit compilers related to printf() formats.
  • Fix reconfigure issues after disabling/reenabling the GANG PreemptMode.
  • Fix race condition where a cgroup was being deleted while another step was creating it.
  • Set the slurmd port correctly if multi-slurmd
  • Fix FAIL mail not being sent if a job was cancelled due to preemption.
  • slurmrestd - move debug logs for HTTP handling to be gated by debugflag NETWORK to avoid unnecessary logging of communication contents.
  • Fix issue with bad memory access when shrinking running steps.
  • Fix various issues with internal job accounting with GRES when jobs are shrunk.
  • Fix ipmi polling on slurmd reconfig or restart.
  • Fix srun crash when reserved ports are being used and het step fails to launch.
  • openapi/dbv0.0.37 - fix DELETE execution path on /user/{user_name}.
  • slurmctld - Properly requeue all components of a het job if…

This update for pdsh, slurm_22_05 fixes the following issues:

Slurm was updated to 22.05.5

• Fixes a number of moderate severity issues, noteable are:

  • Load hash plugin at slurmstepd launch time to prevent issues loading the plugin at step completion if the Slurm installation is upgraded.
  • Update nvml plugin to match the unique id format for MIG devices in new Nvidia drivers.
  • Fix multi-node step launch failure when nodes in the controller aren't in natural order. This can happen with inconsistent node naming (such as node15 and node052) or with dynamic nodes which can register in any order.
  • job_container/tmpfs - cleanup containers even when the .ns file isn't mounted anymore.
  • Wait up to PrologEpilogTimeout before shutting down slurmd to allow prolog and epilog scripts to complete or timeout. Previously, slurmd waited 120 seconds before timing out and killing prolog and epilog scripts.

• Do not deduplicate files of testsuite Slurm configuration. This directory is supposed to be mounted over /etc/slurm therefore it must not contain softlinks to the files in this directory.

• Fix a potential security vulnerability in the test package (bsc#1201674, CVE-2022-31251).

• update to 22.05.2 with following fixes:

  • Fix regression which allowed the oversubscription of licenses.
  • Fix a segfault in slurmctld when requesting gres in job arrays.

• Allow log in as user 'slurm'. This allows admins to run certain priviledged commands more easily without becoming root.

update to 22.05.0 with following changes:

• Support for dynamic node addition and removal

• Support for native Linux cgroup v2 operation

• Newly added plugins to support HPE Slingshot 11 networks (switch/hpe_slingshot), and Intel Xe GPUs (gpu/oneapi)

• Added new acct_gather_interconnect/sysfs plugin to collect statistics from arbitrary network interfaces.

• Expanded and synced set of environment variables available in the Prolog/Epilog/PrologSlurmctld/EpilogSlurmctld scripts.

• New '--prefer' option to job submissions to allow for a 'soft constraint' request to influence node selection.

• Optional support for license planning in the backfill scheduler with 'bf_licenses' option in SchedulerParameters.

• Add a comment about the CommunicationParameters=block_null_hash option warning users who migrate - just in case.

• Update to 21.08.8 which fixes CVE-2022-29500 (bsc#1199278), CVE-2022-29501 (bsc#1199279), and CVE-2022-29502 (bsc#1199281).

• Added 'CommunicationParameters=block_null_hash' to slurm.conf, please add this parameter to existing configurations.

• Update to 21.08.7 with following changes:

  • openapi/v0.0.37 - correct calculation for bf_queue_len_mean in /diag.
  • Avoid shrinking a reservation when overlapping with downed nodes.
  • Only check TRES limits against current usage for TRES requested by the job.
  • Do not allocate shared gres (MPS) in whole-node allocations
  • Constrain slurmstepd to job/step cgroup like in previous versions of Slurm.
  • Fix warnings on 32-bit compilers related to printf() formats.
  • Fix reconfigure issues after disabling/reenabling the GANG PreemptMode.
  • Fix race condition where a cgroup was being deleted while another step was creating it.
  • Set the slurmd port correctly if multi-slurmd
  • Fix FAIL mail not being sent if a job was cancelled due to preemption.
  • slurmrestd - move debug logs for HTTP handling to be gated by debugflag NETWORK to avoid unnecessary logging of communication contents.
  • Fix issue with bad memory access when shrinking running steps.
  • Fix various issues with internal job accounting with GRES when jobs are shrunk.
  • Fix ipmi polling on slurmd reconfig or restart.
  • Fix srun crash when reserved ports are being used and het step fails to launch.
  • openapi/dbv0.0.37 - fix DELETE execution path on /user/{user_name}.
  • slurmctld - Properly requeue all components of a het job if…

This update for pdsh, slurm_22_05 fixes the following issues:

Slurm was updated to 22.05.5

• Fixes a number of moderate severity issues, noteable are:

  • Load hash plugin at slurmstepd launch time to prevent issues loading the plugin at step completion if the Slurm installation is upgraded.
  • Update nvml plugin to match the unique id format for MIG devices in new Nvidia drivers.
  • Fix multi-node step launch failure when nodes in the controller aren't in natural order. This can happen with inconsistent node naming (such as node15 and node052) or with dynamic nodes which can register in any order.
  • job_container/tmpfs - cleanup containers even when the .ns file isn't mounted anymore.
  • Wait up to PrologEpilogTimeout before shutting down slurmd to allow prolog and epilog scripts to complete or timeout. Previously, slurmd waited 120 seconds before timing out and killing prolog and epilog scripts.

• Do not deduplicate files of testsuite Slurm configuration. This directory is supposed to be mounted over /etc/slurm therefore it must not contain softlinks to the files in this directory.

• Fix a potential security vulnerability in the test package (bsc#1201674, CVE-2022-31251).

• update to 22.05.2 with following fixes:

  • Fix regression which allowed the oversubscription of licenses.
  • Fix a segfault in slurmctld when requesting gres in job arrays.

• Allow log in as user 'slurm'. This allows admins to run certain priviledged commands more easily without becoming root.

update to 22.05.0 with following changes:

• Support for dynamic node addition and removal

• Support for native Linux cgroup v2 operation

• Newly added plugins to support HPE Slingshot 11 networks (switch/hpe_slingshot), and Intel Xe GPUs (gpu/oneapi)

• Added new acct_gather_interconnect/sysfs plugin to collect statistics from arbitrary network interfaces.

• Expanded and synced set of environment variables available in the Prolog/Epilog/PrologSlurmctld/EpilogSlurmctld scripts.

• New '--prefer' option to job submissions to allow for a 'soft constraint' request to influence node selection.

• Optional support for license planning in the backfill scheduler with 'bf_licenses' option in SchedulerParameters.

• Add a comment about the CommunicationParameters=block_null_hash option warning users who migrate - just in case.

• Update to 21.08.8 which fixes CVE-2022-29500 (bsc#1199278), CVE-2022-29501 (bsc#1199279), and CVE-2022-29502 (bsc#1199281).

• Added 'CommunicationParameters=block_null_hash' to slurm.conf, please add this parameter to existing configurations.

• Update to 21.08.7 with following changes:

  • openapi/v0.0.37 - correct calculation for bf_queue_len_mean in /diag.
  • Avoid shrinking a reservation when overlapping with downed nodes.
  • Only check TRES limits against current usage for TRES requested by the job.
  • Do not allocate shared gres (MPS) in whole-node allocations
  • Constrain slurmstepd to job/step cgroup like in previous versions of Slurm.
  • Fix warnings on 32-bit compilers related to printf() formats.
  • Fix reconfigure issues after disabling/reenabling the GANG PreemptMode.
  • Fix race condition where a cgroup was being deleted while another step was creating it.
  • Set the slurmd port correctly if multi-slurmd
  • Fix FAIL mail not being sent if a job was cancelled due to preemption.
  • slurmrestd - move debug logs for HTTP handling to be gated by debugflag NETWORK to avoid unnecessary logging of communication contents.
  • Fix issue with bad memory access when shrinking running steps.
  • Fix various issues with internal job accounting with GRES when jobs are shrunk.
  • Fix ipmi polling on slurmd reconfig or restart.
  • Fix srun crash when reserved ports are being used and het step fails to launch.
  • openapi/dbv0.0.37 - fix DELETE execution path on /user/{user_name}.
  • slurmctld - Properly requeue all components of a het job if…

This update for pdsh, slurm_22_05 fixes the following issues:

Slurm was updated to 22.05.5

• Fixes a number of moderate severity issues, noteable are:

  • Load hash plugin at slurmstepd launch time to prevent issues loading the plugin at step completion if the Slurm installation is upgraded.
  • Update nvml plugin to match the unique id format for MIG devices in new Nvidia drivers.
  • Fix multi-node step launch failure when nodes in the controller aren't in natural order. This can happen with inconsistent node naming (such as node15 and node052) or with dynamic nodes which can register in any order.
  • job_container/tmpfs - cleanup containers even when the .ns file isn't mounted anymore.
  • Wait up to PrologEpilogTimeout before shutting down slurmd to allow prolog and epilog scripts to complete or timeout. Previously, slurmd waited 120 seconds before timing out and killing prolog and epilog scripts.

• Do not deduplicate files of testsuite Slurm configuration. This directory is supposed to be mounted over /etc/slurm therefore it must not contain softlinks to the files in this directory.

• Fix a potential security vulnerability in the test package (bsc#1201674, CVE-2022-31251).

• update to 22.05.2 with following fixes:

  • Fix regression which allowed the oversubscription of licenses.
  • Fix a segfault in slurmctld when requesting gres in job arrays.

• Allow log in as user 'slurm'. This allows admins to run certain priviledged commands more easily without becoming root.

update to 22.05.0 with following changes:

• Support for dynamic node addition and removal

• Support for native Linux cgroup v2 operation

• Newly added plugins to support HPE Slingshot 11 networks (switch/hpe_slingshot), and Intel Xe GPUs (gpu/oneapi)

• Added new acct_gather_interconnect/sysfs plugin to collect statistics from arbitrary network interfaces.

• Expanded and synced set of environment variables available in the Prolog/Epilog/PrologSlurmctld/EpilogSlurmctld scripts.

• New '--prefer' option to job submissions to allow for a 'soft constraint' request to influence node selection.

• Optional support for license planning in the backfill scheduler with 'bf_licenses' option in SchedulerParameters.

• Add a comment about the CommunicationParameters=block_null_hash option warning users who migrate - just in case.

• Update to 21.08.8 which fixes CVE-2022-29500 (bsc#1199278), CVE-2022-29501 (bsc#1199279), and CVE-2022-29502 (bsc#1199281).

• Added 'CommunicationParameters=block_null_hash' to slurm.conf, please add this parameter to existing configurations.

• Update to 21.08.7 with following changes:

  • openapi/v0.0.37 - correct calculation for bf_queue_len_mean in /diag.
  • Avoid shrinking a reservation when overlapping with downed nodes.
  • Only check TRES limits against current usage for TRES requested by the job.
  • Do not allocate shared gres (MPS) in whole-node allocations
  • Constrain slurmstepd to job/step cgroup like in previous versions of Slurm.
  • Fix warnings on 32-bit compilers related to printf() formats.
  • Fix reconfigure issues after disabling/reenabling the GANG PreemptMode.
  • Fix race condition where a cgroup was being deleted while another step was creating it.
  • Set the slurmd port correctly if multi-slurmd
  • Fix FAIL mail not being sent if a job was cancelled due to preemption.
  • slurmrestd - move debug logs for HTTP handling to be gated by debugflag NETWORK to avoid unnecessary logging of communication contents.
  • Fix issue with bad memory access when shrinking running steps.
  • Fix various issues with internal job accounting with GRES when jobs are shrunk.
  • Fix ipmi polling on slurmd reconfig or restart.
  • Fix srun crash when reserved ports are being used and het step fails to launch.
  • openapi/dbv0.0.37 - fix DELETE execution path on /user/{user_name}.
  • slurmctld - Properly requeue all components of a het job if…

This update for slurm fixes the following issues:

• Updated to version 23.02.5 with the following changes:

  • Bug Fixes:

    • Revert a change in 23.02 where SLURM_NTASKS was no longer set in the job's environment when --ntasks-per-node was requested. The method that is is being set, however, is different and should be more accurate in more situations.
    • Change pmi2 plugin to honor the SrunPortRange option. This matches the new behavior of the pmix plugin in 23.02.0. Note that neither of these plugins makes use of the MpiParams=ports= option, and previously were only limited by the systems ephemeral port range.
    • Fix regression in 23.02.2 that caused slurmctld -R to crash on startup if a node features plugin is configured.
    • Fix and prevent reoccurring reservations from overlapping.
    • job_container/tmpfs - Avoid attempts to share BasePath between nodes.
    • With CR_Cpu_Memory, fix node selection for jobs that request gres and --mem-per-cpu.
    • Fix a regression from 22.05.7 in which some jobs were allocated too few nodes, thus overcommitting cpus to some tasks.
    • Fix a job being stuck in the completing state if the job ends while the primary controller is down or unresponsive and the backup controller has not yet taken over.
    • Fix slurmctld segfault when a node registers with a configured CpuSpecList while slurmctld configuration has the node without CpuSpecList.
    • Fix cloud nodes getting stuck in POWERED_DOWN+NO_RESPOND state after not registering by ResumeTimeout.
    • slurmstepd - Avoid cleanup of config.json-less containers spooldir getting skipped.
    • Fix scontrol segfault when 'completing' command requested repeatedly in interactive mode.
    • Properly handle a race condition between bind() and listen() calls in the network stack when running with SrunPortRange set.
    • Federation - Fix revoked jobs being returned regardless of the -a/--all option for privileged users.
    • Federation - Fix canceling pending federated jobs from non-origin clusters which could leave federated jobs orphaned from the origin cluster.
    • Fix sinfo segfault when printing multiple clusters with --noheader option.
    • Federation - fix clusters not syncing if clusters are added to a federation before they have registered with the dbd.
    • node_features/helpers - Fix node selection for jobs requesting changeable. features with the | operator, which could prevent jobs from running on some valid nodes.
    • node_features/helpers - Fix inconsistent handling of & and |, where an AND'd feature was sometimes AND'd to all sets of features instead of just the current set. E.g. foo|bar&baz was interpreted as {foo,baz} or {bar,baz} instead of how it is documented: {foo} or {bar,baz}.
    • Fix job accounting so that when a job is requeued its allocated node count is cleared. After the requeue, sacct will correctly show that the job has 0 AllocNodes while it is pending or if it is canceled before restarting.
    • sacct - AllocCPUS now correctly shows 0 if a job has not yet received an allocation or if the job was canceled before getting one.
    • Fix intel OneAPI autodetect: detect the /dev/dri/renderD[0-9]+ GPUs, and do not detect /dev/dri/card[0-9]+.
    • Fix node selection for jobs that request --gpus and a number of tasks fewer than GPUs, which resulted in incorrectly rejecting these jobs.
    • Remove MYSQL_OPT_RECONNECT completely.
    • Fix cloud nodes in POWERING_UP state disappearing (getting set to FUTURE) when an scontrol reconfigure happens.
    • openapi/dbv0.0.39 - Avoid assert / segfault on missing coordinators list.
    • slurmrestd - Correct memory leak while parsing OpenAPI…

This update for slurm_23_02 fixes the following issues:

• Updated to version 23.02.5 with the following changes:

  • Bug Fixes:

    • Revert a change in 23.02 where SLURM_NTASKS was no longer set in the job's environment when --ntasks-per-node was requested. The method that is is being set, however, is different and should be more accurate in more situations.
    • Change pmi2 plugin to honor the SrunPortRange option. This matches the new behavior of the pmix plugin in 23.02.0. Note that neither of these plugins makes use of the MpiParams=ports= option, and previously were only limited by the systems ephemeral port range.
    • Fix regression in 23.02.2 that caused slurmctld -R to crash on startup if a node features plugin is configured.
    • Fix and prevent reoccurring reservations from overlapping.
    • job_container/tmpfs - Avoid attempts to share BasePath between nodes.
    • With CR_Cpu_Memory, fix node selection for jobs that request gres and --mem-per-cpu.
    • Fix a regression from 22.05.7 in which some jobs were allocated too few nodes, thus overcommitting cpus to some tasks.
    • Fix a job being stuck in the completing state if the job ends while the primary controller is down or unresponsive and the backup controller has not yet taken over.
    • Fix slurmctld segfault when a node registers with a configured CpuSpecList while slurmctld configuration has the node without CpuSpecList.
    • Fix cloud nodes getting stuck in POWERED_DOWN+NO_RESPOND state after not registering by ResumeTimeout.
    • slurmstepd - Avoid cleanup of config.json-less containers spooldir getting skipped.
    • Fix scontrol segfault when 'completing' command requested repeatedly in interactive mode.
    • Properly handle a race condition between bind() and listen() calls in the network stack when running with SrunPortRange set.
    • Federation - Fix revoked jobs being returned regardless of the -a/--all option for privileged users.
    • Federation - Fix canceling pending federated jobs from non-origin clusters which could leave federated jobs orphaned from the origin cluster.
    • Fix sinfo segfault when printing multiple clusters with --noheader option.
    • Federation - fix clusters not syncing if clusters are added to a federation before they have registered with the dbd.
    • node_features/helpers - Fix node selection for jobs requesting changeable. features with the | operator, which could prevent jobs from running on some valid nodes.
    • node_features/helpers - Fix inconsistent handling of & and |, where an AND'd feature was sometimes AND'd to all sets of features instead of just the current set. E.g. foo|bar&baz was interpreted as {foo,baz} or {bar,baz} instead of how it is documented: {foo} or {bar,baz}.
    • Fix job accounting so that when a job is requeued its allocated node count is cleared. After the requeue, sacct will correctly show that the job has 0 AllocNodes while it is pending or if it is canceled before restarting.
    • sacct - AllocCPUS now correctly shows 0 if a job has not yet received an allocation or if the job was canceled before getting one.
    • Fix intel OneAPI autodetect: detect the /dev/dri/renderD[0-9]+ GPUs, and do not detect /dev/dri/card[0-9]+.
    • Fix node selection for jobs that request --gpus and a number of tasks fewer than GPUs, which resulted in incorrectly rejecting these jobs.
    • Remove MYSQL_OPT_RECONNECT completely.
    • Fix cloud nodes in POWERING_UP state disappearing (getting set to FUTURE) when an scontrol reconfigure happens.
    • openapi/dbv0.0.39 - Avoid assert / segfault on missing coordinators list.
    • slurmrestd - Correct memory leak while parsing…

This update for slurm_23_02 fixes the following issues:

• Updated to version 23.02.5 with the following changes:

  • Bug Fixes:

    • Revert a change in 23.02 where SLURM_NTASKS was no longer set in the job's environment when --ntasks-per-node was requested. The method that is is being set, however, is different and should be more accurate in more situations.
    • Change pmi2 plugin to honor the SrunPortRange option. This matches the new behavior of the pmix plugin in 23.02.0. Note that neither of these plugins makes use of the MpiParams=ports= option, and previously were only limited by the systems ephemeral port range.
    • Fix regression in 23.02.2 that caused slurmctld -R to crash on startup if a node features plugin is configured.
    • Fix and prevent reoccurring reservations from overlapping.
    • job_container/tmpfs - Avoid attempts to share BasePath between nodes.
    • With CR_Cpu_Memory, fix node selection for jobs that request gres and --mem-per-cpu.
    • Fix a regression from 22.05.7 in which some jobs were allocated too few nodes, thus overcommitting cpus to some tasks.
    • Fix a job being stuck in the completing state if the job ends while the primary controller is down or unresponsive and the backup controller has not yet taken over.
    • Fix slurmctld segfault when a node registers with a configured CpuSpecList while slurmctld configuration has the node without CpuSpecList.
    • Fix cloud nodes getting stuck in POWERED_DOWN+NO_RESPOND state after not registering by ResumeTimeout.
    • slurmstepd - Avoid cleanup of config.json-less containers spooldir getting skipped.
    • Fix scontrol segfault when 'completing' command requested repeatedly in interactive mode.
    • Properly handle a race condition between bind() and listen() calls in the network stack when running with SrunPortRange set.
    • Federation - Fix revoked jobs being returned regardless of the -a/--all option for privileged users.
    • Federation - Fix canceling pending federated jobs from non-origin clusters which could leave federated jobs orphaned from the origin cluster.
    • Fix sinfo segfault when printing multiple clusters with --noheader option.
    • Federation - fix clusters not syncing if clusters are added to a federation before they have registered with the dbd.
    • node_features/helpers - Fix node selection for jobs requesting changeable. features with the | operator, which could prevent jobs from running on some valid nodes.
    • node_features/helpers - Fix inconsistent handling of & and |, where an AND'd feature was sometimes AND'd to all sets of features instead of just the current set. E.g. foo|bar&baz was interpreted as {foo,baz} or {bar,baz} instead of how it is documented: {foo} or {bar,baz}.
    • Fix job accounting so that when a job is requeued its allocated node count is cleared. After the requeue, sacct will correctly show that the job has 0 AllocNodes while it is pending or if it is canceled before restarting.
    • sacct - AllocCPUS now correctly shows 0 if a job has not yet received an allocation or if the job was canceled before getting one.
    • Fix intel OneAPI autodetect: detect the /dev/dri/renderD[0-9]+ GPUs, and do not detect /dev/dri/card[0-9]+.
    • Fix node selection for jobs that request --gpus and a number of tasks fewer than GPUs, which resulted in incorrectly rejecting these jobs.
    • Remove MYSQL_OPT_RECONNECT completely.
    • Fix cloud nodes in POWERING_UP state disappearing (getting set to FUTURE) when an scontrol reconfigure happens.
    • openapi/dbv0.0.39 - Avoid assert / segfault on missing coordinators list.
    • slurmrestd - Correct memory leak while parsing…

This update for slurm_23_02 fixes the following issues:

• Updated to version 23.02.5 with the following changes:

  • Bug Fixes:

    • Revert a change in 23.02 where SLURM_NTASKS was no longer set in the job's environment when --ntasks-per-node was requested. The method that is is being set, however, is different and should be more accurate in more situations.
    • Change pmi2 plugin to honor the SrunPortRange option. This matches the new behavior of the pmix plugin in 23.02.0. Note that neither of these plugins makes use of the MpiParams=ports= option, and previously were only limited by the systems ephemeral port range.
    • Fix regression in 23.02.2 that caused slurmctld -R to crash on startup if a node features plugin is configured.
    • Fix and prevent reoccurring reservations from overlapping.
    • job_container/tmpfs - Avoid attempts to share BasePath between nodes.
    • With CR_Cpu_Memory, fix node selection for jobs that request gres and --mem-per-cpu.
    • Fix a regression from 22.05.7 in which some jobs were allocated too few nodes, thus overcommitting cpus to some tasks.
    • Fix a job being stuck in the completing state if the job ends while the primary controller is down or unresponsive and the backup controller has not yet taken over.
    • Fix slurmctld segfault when a node registers with a configured CpuSpecList while slurmctld configuration has the node without CpuSpecList.
    • Fix cloud nodes getting stuck in POWERED_DOWN+NO_RESPOND state after not registering by ResumeTimeout.
    • slurmstepd - Avoid cleanup of config.json-less containers spooldir getting skipped.
    • Fix scontrol segfault when 'completing' command requested repeatedly in interactive mode.
    • Properly handle a race condition between bind() and listen() calls in the network stack when running with SrunPortRange set.
    • Federation - Fix revoked jobs being returned regardless of the -a/--all option for privileged users.
    • Federation - Fix canceling pending federated jobs from non-origin clusters which could leave federated jobs orphaned from the origin cluster.
    • Fix sinfo segfault when printing multiple clusters with --noheader option.
    • Federation - fix clusters not syncing if clusters are added to a federation before they have registered with the dbd.
    • node_features/helpers - Fix node selection for jobs requesting changeable. features with the | operator, which could prevent jobs from running on some valid nodes.
    • node_features/helpers - Fix inconsistent handling of & and |, where an AND'd feature was sometimes AND'd to all sets of features instead of just the current set. E.g. foo|bar&baz was interpreted as {foo,baz} or {bar,baz} instead of how it is documented: {foo} or {bar,baz}.
    • Fix job accounting so that when a job is requeued its allocated node count is cleared. After the requeue, sacct will correctly show that the job has 0 AllocNodes while it is pending or if it is canceled before restarting.
    • sacct - AllocCPUS now correctly shows 0 if a job has not yet received an allocation or if the job was canceled before getting one.
    • Fix intel OneAPI autodetect: detect the /dev/dri/renderD[0-9]+ GPUs, and do not detect /dev/dri/card[0-9]+.
    • Fix node selection for jobs that request --gpus and a number of tasks fewer than GPUs, which resulted in incorrectly rejecting these jobs.
    • Remove MYSQL_OPT_RECONNECT completely.
    • Fix cloud nodes in POWERING_UP state disappearing (getting set to FUTURE) when an scontrol reconfigure happens.
    • openapi/dbv0.0.39 - Avoid assert / segfault on missing coordinators list.
    • slurmrestd - Correct memory leak while parsing…

This update for slurm_23_02 fixes the following issues:

• Updated to version 23.02.5 with the following changes:

  • Bug Fixes:

    • Revert a change in 23.02 where SLURM_NTASKS was no longer set in the job's environment when --ntasks-per-node was requested. The method that is is being set, however, is different and should be more accurate in more situations.
    • Change pmi2 plugin to honor the SrunPortRange option. This matches the new behavior of the pmix plugin in 23.02.0. Note that neither of these plugins makes use of the MpiParams=ports= option, and previously were only limited by the systems ephemeral port range.
    • Fix regression in 23.02.2 that caused slurmctld -R to crash on startup if a node features plugin is configured.
    • Fix and prevent reoccurring reservations from overlapping.
    • job_container/tmpfs - Avoid attempts to share BasePath between nodes.
    • With CR_Cpu_Memory, fix node selection for jobs that request gres and --mem-per-cpu.
    • Fix a regression from 22.05.7 in which some jobs were allocated too few nodes, thus overcommitting cpus to some tasks.
    • Fix a job being stuck in the completing state if the job ends while the primary controller is down or unresponsive and the backup controller has not yet taken over.
    • Fix slurmctld segfault when a node registers with a configured CpuSpecList while slurmctld configuration has the node without CpuSpecList.
    • Fix cloud nodes getting stuck in POWERED_DOWN+NO_RESPOND state after not registering by ResumeTimeout.
    • slurmstepd - Avoid cleanup of config.json-less containers spooldir getting skipped.
    • Fix scontrol segfault when 'completing' command requested repeatedly in interactive mode.
    • Properly handle a race condition between bind() and listen() calls in the network stack when running with SrunPortRange set.
    • Federation - Fix revoked jobs being returned regardless of the -a/--all option for privileged users.
    • Federation - Fix canceling pending federated jobs from non-origin clusters which could leave federated jobs orphaned from the origin cluster.
    • Fix sinfo segfault when printing multiple clusters with --noheader option.
    • Federation - fix clusters not syncing if clusters are added to a federation before they have registered with the dbd.
    • node_features/helpers - Fix node selection for jobs requesting changeable. features with the | operator, which could prevent jobs from running on some valid nodes.
    • node_features/helpers - Fix inconsistent handling of & and |, where an AND'd feature was sometimes AND'd to all sets of features instead of just the current set. E.g. foo|bar&baz was interpreted as {foo,baz} or {bar,baz} instead of how it is documented: {foo} or {bar,baz}.
    • Fix job accounting so that when a job is requeued its allocated node count is cleared. After the requeue, sacct will correctly show that the job has 0 AllocNodes while it is pending or if it is canceled before restarting.
    • sacct - AllocCPUS now correctly shows 0 if a job has not yet received an allocation or if the job was canceled before getting one.
    • Fix intel OneAPI autodetect: detect the /dev/dri/renderD[0-9]+ GPUs, and do not detect /dev/dri/card[0-9]+.
    • Fix node selection for jobs that request --gpus and a number of tasks fewer than GPUs, which resulted in incorrectly rejecting these jobs.
    • Remove MYSQL_OPT_RECONNECT completely.
    • Fix cloud nodes in POWERING_UP state disappearing (getting set to FUTURE) when an scontrol reconfigure happens.
    • openapi/dbv0.0.39 - Avoid assert / segfault on missing coordinators list.
    • slurmrestd - Correct memory leak while parsing…

This update for slurm fixes the following issues:

• CVE-2022-29500: Fixed architectural flaw that could have been exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a problem that an unprivileged user could have sent data to arbitrary unix socket as root (bsc#1199279).

This update for slurm_20_11 fixes the following issues:

• CVE-2022-29500: Fixed architectural flaw that could have been exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a problem that an unprivileged user could have sent data to arbitrary unix socket as root (bsc#1199279).

This update for slurm_20_11 fixes the following issues:

• CVE-2022-29500: Fixed architectural flaw that could have been exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a problem that an unprivileged user could have sent data to arbitrary unix socket as root (bsc#1199279).

This update for slurm_20_11 fixes the following issues:

• CVE-2022-29500: Fixed architectural flaw that could have been exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a problem that an unprivileged user could have sent data to arbitrary unix socket as root (bsc#1199279).

This update for slurm_18_08 fixes the following issues:

• CVE-2022-31251: Fixed a potential security vulnerability in the test package (bsc#1201674).
• CVE-2022-29500: Fixed an architectural flaw can be exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a vulnerability where an unprivileged user can send data to arbitrary unix socket as root (bsc#1199279).

This update for slurm_18_08 fixes the following issues:

• CVE-2022-31251: Fixed a potential security vulnerability in the test package (bsc#1201674).
• CVE-2022-29500: Fixed an architectural flaw can be exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a vulnerability where an unprivileged user can send data to arbitrary unix socket as root (bsc#1199279).

This update for slurm fixes the following issues:

• CVE-2022-31251: Fixed a potential security vulnerability in the test package (bsc#1201674).
• CVE-2022-29500: Fixed an architectural flaw can be exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a vulnerability where an unprivileged user can send data to arbitrary unix socket as root (bsc#1199279).

This update for slurm_20_02 fixes the following issues:

• CVE-2022-31251: Fixed a potential security vulnerability in the test package (bsc#1201674).
• CVE-2022-29500: Fixed architectural flaw that could have been exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a problem that an unprivileged user could have sent data to arbitrary unix socket as root (bsc#1199279).

Bugfixes:

• Fixed qstat error message (torque wrapper) (bsc#1186646).

This update for slurm fixes the following issues:

• CVE-2022-31251: Fixed a potential security vulnerability in the test package (bsc#1201674).
• CVE-2022-29500: Fixed an architectural flaw can be exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a vulnerability where an unprivileged user can send data to arbitrary unix socket as root (bsc#1199279).

This update for slurm_20_02 fixes the following issues:

• CVE-2022-31251: Fixed security vulnerability in the test package (bsc#1201674).
• CVE-2022-29500: Fixed architectural flaw that can be exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed vulnerability where an unprivileged user can send data to arbitrary unix socket as root (bsc#1199279).

Bugfixes:

• Fixed qstat error message (torque wrapper) (bsc#1186646).

This update for slurm fixes the following issues:

• CVE-2022-31251: Fixed a potential security vulnerability in the test package (bsc#1201674).
• CVE-2022-29500: Fixed architectural flaw that could have been exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a problem that an unprivileged user could have sent data to arbitrary unix socket as root (bsc#1199279).

This update for slurm fixes the following issues:

• CVE-2022-31251: Fixed a potential security vulnerability in the test package (bsc#1201674).
• CVE-2022-29500: Fixed architectural flaw that could have been exploited to allow an unprivileged user to execute arbitrary processes as root (bsc#1199278).
• CVE-2022-29501: Fixed a problem that an unprivileged user could have sent data to arbitrary unix socket as root (bsc#1199279).

It was discovered that Slurm did not properly handle credential management, which could allow an unprivileged user to impersonate the SlurmUser account. An attacker could possibly use this issue to execute arbitrary code as the root user. (CVE-2022-29500)

It was discovered that Slurm did not properly handle access control when dealing with RPC traffic through PMI2 and PMIx, which could allow an unprivileged user to send data to an arbitrary unix socket in the host. An attacker could possibly use this issue to execute arbitrary code as the root user. (CVE-2022-29501)

It was discovered that Slurm did not properly handle validation logic when processing input and output data with the srun client, which could lead to the interception of process I/O. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-29502)