CVE-2022-29502

SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges.

These are all security issues fixed in the libnss_slurm2-21.08.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update for pdsh, slurm_22_05 fixes the following issues:

Slurm was updated to 22.05.5

• Fixes a number of moderate severity issues, noteable are:

  • Load hash plugin at slurmstepd launch time to prevent issues loading the plugin at step completion if the Slurm installation is upgraded.
  • Update nvml plugin to match the unique id format for MIG devices in new Nvidia drivers.
  • Fix multi-node step launch failure when nodes in the controller aren't in natural order. This can happen with inconsistent node naming (such as node15 and node052) or with dynamic nodes which can register in any order.
  • job_container/tmpfs - cleanup containers even when the .ns file isn't mounted anymore.
  • Wait up to PrologEpilogTimeout before shutting down slurmd to allow prolog and epilog scripts to complete or timeout. Previously, slurmd waited 120 seconds before timing out and killing prolog and epilog scripts.

• Do not deduplicate files of testsuite Slurm configuration. This directory is supposed to be mounted over /etc/slurm therefore it must not contain softlinks to the files in this directory.

• Fix a potential security vulnerability in the test package (bsc#1201674, CVE-2022-31251).

• update to 22.05.2 with following fixes:

  • Fix regression which allowed the oversubscription of licenses.
  • Fix a segfault in slurmctld when requesting gres in job arrays.

• Allow log in as user 'slurm'. This allows admins to run certain priviledged commands more easily without becoming root.

update to 22.05.0 with following changes:

• Support for dynamic node addition and removal

• Support for native Linux cgroup v2 operation

• Newly added plugins to support HPE Slingshot 11 networks (switch/hpe_slingshot), and Intel Xe GPUs (gpu/oneapi)

• Added new acct_gather_interconnect/sysfs plugin to collect statistics from arbitrary network interfaces.

• Expanded and synced set of environment variables available in the Prolog/Epilog/PrologSlurmctld/EpilogSlurmctld scripts.

• New '--prefer' option to job submissions to allow for a 'soft constraint' request to influence node selection.

• Optional support for license planning in the backfill scheduler with 'bf_licenses' option in SchedulerParameters.

• Add a comment about the CommunicationParameters=block_null_hash option warning users who migrate - just in case.

• Update to 21.08.8 which fixes CVE-2022-29500 (bsc#1199278), CVE-2022-29501 (bsc#1199279), and CVE-2022-29502 (bsc#1199281).

• Added 'CommunicationParameters=block_null_hash' to slurm.conf, please add this parameter to existing configurations.

• Update to 21.08.7 with following changes:

  • openapi/v0.0.37 - correct calculation for bf_queue_len_mean in /diag.
  • Avoid shrinking a reservation when overlapping with downed nodes.
  • Only check TRES limits against current usage for TRES requested by the job.
  • Do not allocate shared gres (MPS) in whole-node allocations
  • Constrain slurmstepd to job/step cgroup like in previous versions of Slurm.
  • Fix warnings on 32-bit compilers related to printf() formats.
  • Fix reconfigure issues after disabling/reenabling the GANG PreemptMode.
  • Fix race condition where a cgroup was being deleted while another step was creating it.
  • Set the slurmd port correctly if multi-slurmd
  • Fix FAIL mail not being sent if a job was cancelled due to preemption.
  • slurmrestd - move debug logs for HTTP handling to be gated by debugflag NETWORK to avoid unnecessary logging of communication contents.
  • Fix issue with bad memory access when shrinking running steps.
  • Fix various issues with internal job accounting with GRES when jobs are shrunk.
  • Fix ipmi polling on slurmd reconfig or restart.
  • Fix srun crash when reserved ports are being used and het step fails to launch.
  • openapi/dbv0.0.37 - fix DELETE execution path on /user/{user_name}.
  • slurmctld - Properly requeue all components of a het job if…

This update for pdsh, slurm_22_05 fixes the following issues:

Slurm was updated to 22.05.5

• Fixes a number of moderate severity issues, noteable are:

  • Load hash plugin at slurmstepd launch time to prevent issues loading the plugin at step completion if the Slurm installation is upgraded.
  • Update nvml plugin to match the unique id format for MIG devices in new Nvidia drivers.
  • Fix multi-node step launch failure when nodes in the controller aren't in natural order. This can happen with inconsistent node naming (such as node15 and node052) or with dynamic nodes which can register in any order.
  • job_container/tmpfs - cleanup containers even when the .ns file isn't mounted anymore.
  • Wait up to PrologEpilogTimeout before shutting down slurmd to allow prolog and epilog scripts to complete or timeout. Previously, slurmd waited 120 seconds before timing out and killing prolog and epilog scripts.

• Do not deduplicate files of testsuite Slurm configuration. This directory is supposed to be mounted over /etc/slurm therefore it must not contain softlinks to the files in this directory.

• Fix a potential security vulnerability in the test package (bsc#1201674, CVE-2022-31251).

• update to 22.05.2 with following fixes:

  • Fix regression which allowed the oversubscription of licenses.
  • Fix a segfault in slurmctld when requesting gres in job arrays.

• Allow log in as user 'slurm'. This allows admins to run certain priviledged commands more easily without becoming root.

update to 22.05.0 with following changes:

• Support for dynamic node addition and removal

• Support for native Linux cgroup v2 operation

• Newly added plugins to support HPE Slingshot 11 networks (switch/hpe_slingshot), and Intel Xe GPUs (gpu/oneapi)

• Added new acct_gather_interconnect/sysfs plugin to collect statistics from arbitrary network interfaces.

• Expanded and synced set of environment variables available in the Prolog/Epilog/PrologSlurmctld/EpilogSlurmctld scripts.

• New '--prefer' option to job submissions to allow for a 'soft constraint' request to influence node selection.

• Optional support for license planning in the backfill scheduler with 'bf_licenses' option in SchedulerParameters.

• Add a comment about the CommunicationParameters=block_null_hash option warning users who migrate - just in case.

• Update to 21.08.8 which fixes CVE-2022-29500 (bsc#1199278), CVE-2022-29501 (bsc#1199279), and CVE-2022-29502 (bsc#1199281).

• Added 'CommunicationParameters=block_null_hash' to slurm.conf, please add this parameter to existing configurations.

• Update to 21.08.7 with following changes:

  • openapi/v0.0.37 - correct calculation for bf_queue_len_mean in /diag.
  • Avoid shrinking a reservation when overlapping with downed nodes.
  • Only check TRES limits against current usage for TRES requested by the job.
  • Do not allocate shared gres (MPS) in whole-node allocations
  • Constrain slurmstepd to job/step cgroup like in previous versions of Slurm.
  • Fix warnings on 32-bit compilers related to printf() formats.
  • Fix reconfigure issues after disabling/reenabling the GANG PreemptMode.
  • Fix race condition where a cgroup was being deleted while another step was creating it.
  • Set the slurmd port correctly if multi-slurmd
  • Fix FAIL mail not being sent if a job was cancelled due to preemption.
  • slurmrestd - move debug logs for HTTP handling to be gated by debugflag NETWORK to avoid unnecessary logging of communication contents.
  • Fix issue with bad memory access when shrinking running steps.
  • Fix various issues with internal job accounting with GRES when jobs are shrunk.
  • Fix ipmi polling on slurmd reconfig or restart.
  • Fix srun crash when reserved ports are being used and het step fails to launch.
  • openapi/dbv0.0.37 - fix DELETE execution path on /user/{user_name}.
  • slurmctld - Properly requeue all components of a het job if…

This update for pdsh, slurm_22_05 fixes the following issues:

Slurm was updated to 22.05.5

• Fixes a number of moderate severity issues, noteable are:

  • Load hash plugin at slurmstepd launch time to prevent issues loading the plugin at step completion if the Slurm installation is upgraded.
  • Update nvml plugin to match the unique id format for MIG devices in new Nvidia drivers.
  • Fix multi-node step launch failure when nodes in the controller aren't in natural order. This can happen with inconsistent node naming (such as node15 and node052) or with dynamic nodes which can register in any order.
  • job_container/tmpfs - cleanup containers even when the .ns file isn't mounted anymore.
  • Wait up to PrologEpilogTimeout before shutting down slurmd to allow prolog and epilog scripts to complete or timeout. Previously, slurmd waited 120 seconds before timing out and killing prolog and epilog scripts.

• Do not deduplicate files of testsuite Slurm configuration. This directory is supposed to be mounted over /etc/slurm therefore it must not contain softlinks to the files in this directory.

• Fix a potential security vulnerability in the test package (bsc#1201674, CVE-2022-31251).

• update to 22.05.2 with following fixes:

  • Fix regression which allowed the oversubscription of licenses.
  • Fix a segfault in slurmctld when requesting gres in job arrays.

• Allow log in as user 'slurm'. This allows admins to run certain priviledged commands more easily without becoming root.

update to 22.05.0 with following changes:

• Support for dynamic node addition and removal

• Support for native Linux cgroup v2 operation

• Newly added plugins to support HPE Slingshot 11 networks (switch/hpe_slingshot), and Intel Xe GPUs (gpu/oneapi)

• Added new acct_gather_interconnect/sysfs plugin to collect statistics from arbitrary network interfaces.

• Expanded and synced set of environment variables available in the Prolog/Epilog/PrologSlurmctld/EpilogSlurmctld scripts.

• New '--prefer' option to job submissions to allow for a 'soft constraint' request to influence node selection.

• Optional support for license planning in the backfill scheduler with 'bf_licenses' option in SchedulerParameters.

• Add a comment about the CommunicationParameters=block_null_hash option warning users who migrate - just in case.

• Update to 21.08.8 which fixes CVE-2022-29500 (bsc#1199278), CVE-2022-29501 (bsc#1199279), and CVE-2022-29502 (bsc#1199281).

• Added 'CommunicationParameters=block_null_hash' to slurm.conf, please add this parameter to existing configurations.

• Update to 21.08.7 with following changes:

  • openapi/v0.0.37 - correct calculation for bf_queue_len_mean in /diag.
  • Avoid shrinking a reservation when overlapping with downed nodes.
  • Only check TRES limits against current usage for TRES requested by the job.
  • Do not allocate shared gres (MPS) in whole-node allocations
  • Constrain slurmstepd to job/step cgroup like in previous versions of Slurm.
  • Fix warnings on 32-bit compilers related to printf() formats.
  • Fix reconfigure issues after disabling/reenabling the GANG PreemptMode.
  • Fix race condition where a cgroup was being deleted while another step was creating it.
  • Set the slurmd port correctly if multi-slurmd
  • Fix FAIL mail not being sent if a job was cancelled due to preemption.
  • slurmrestd - move debug logs for HTTP handling to be gated by debugflag NETWORK to avoid unnecessary logging of communication contents.
  • Fix issue with bad memory access when shrinking running steps.
  • Fix various issues with internal job accounting with GRES when jobs are shrunk.
  • Fix ipmi polling on slurmd reconfig or restart.
  • Fix srun crash when reserved ports are being used and het step fails to launch.
  • openapi/dbv0.0.37 - fix DELETE execution path on /user/{user_name}.
  • slurmctld - Properly requeue all components of a het job if…

This update for pdsh, slurm_22_05 fixes the following issues:

Slurm was updated to 22.05.5

• Fixes a number of moderate severity issues, noteable are:

  • Load hash plugin at slurmstepd launch time to prevent issues loading the plugin at step completion if the Slurm installation is upgraded.
  • Update nvml plugin to match the unique id format for MIG devices in new Nvidia drivers.
  • Fix multi-node step launch failure when nodes in the controller aren't in natural order. This can happen with inconsistent node naming (such as node15 and node052) or with dynamic nodes which can register in any order.
  • job_container/tmpfs - cleanup containers even when the .ns file isn't mounted anymore.
  • Wait up to PrologEpilogTimeout before shutting down slurmd to allow prolog and epilog scripts to complete or timeout. Previously, slurmd waited 120 seconds before timing out and killing prolog and epilog scripts.

• Do not deduplicate files of testsuite Slurm configuration. This directory is supposed to be mounted over /etc/slurm therefore it must not contain softlinks to the files in this directory.

• Fix a potential security vulnerability in the test package (bsc#1201674, CVE-2022-31251).

• update to 22.05.2 with following fixes:

  • Fix regression which allowed the oversubscription of licenses.
  • Fix a segfault in slurmctld when requesting gres in job arrays.

• Allow log in as user 'slurm'. This allows admins to run certain priviledged commands more easily without becoming root.

update to 22.05.0 with following changes:

• Support for dynamic node addition and removal

• Support for native Linux cgroup v2 operation

• Newly added plugins to support HPE Slingshot 11 networks (switch/hpe_slingshot), and Intel Xe GPUs (gpu/oneapi)

• Added new acct_gather_interconnect/sysfs plugin to collect statistics from arbitrary network interfaces.

• Expanded and synced set of environment variables available in the Prolog/Epilog/PrologSlurmctld/EpilogSlurmctld scripts.

• New '--prefer' option to job submissions to allow for a 'soft constraint' request to influence node selection.

• Optional support for license planning in the backfill scheduler with 'bf_licenses' option in SchedulerParameters.

• Add a comment about the CommunicationParameters=block_null_hash option warning users who migrate - just in case.

• Update to 21.08.8 which fixes CVE-2022-29500 (bsc#1199278), CVE-2022-29501 (bsc#1199279), and CVE-2022-29502 (bsc#1199281).

• Added 'CommunicationParameters=block_null_hash' to slurm.conf, please add this parameter to existing configurations.

• Update to 21.08.7 with following changes:

  • openapi/v0.0.37 - correct calculation for bf_queue_len_mean in /diag.
  • Avoid shrinking a reservation when overlapping with downed nodes.
  • Only check TRES limits against current usage for TRES requested by the job.
  • Do not allocate shared gres (MPS) in whole-node allocations
  • Constrain slurmstepd to job/step cgroup like in previous versions of Slurm.
  • Fix warnings on 32-bit compilers related to printf() formats.
  • Fix reconfigure issues after disabling/reenabling the GANG PreemptMode.
  • Fix race condition where a cgroup was being deleted while another step was creating it.
  • Set the slurmd port correctly if multi-slurmd
  • Fix FAIL mail not being sent if a job was cancelled due to preemption.
  • slurmrestd - move debug logs for HTTP handling to be gated by debugflag NETWORK to avoid unnecessary logging of communication contents.
  • Fix issue with bad memory access when shrinking running steps.
  • Fix various issues with internal job accounting with GRES when jobs are shrunk.
  • Fix ipmi polling on slurmd reconfig or restart.
  • Fix srun crash when reserved ports are being used and het step fails to launch.
  • openapi/dbv0.0.37 - fix DELETE execution path on /user/{user_name}.
  • slurmctld - Properly requeue all components of a het job if…

It was discovered that Slurm did not properly handle credential management, which could allow an unprivileged user to impersonate the SlurmUser account. An attacker could possibly use this issue to execute arbitrary code as the root user. (CVE-2022-29500)

It was discovered that Slurm did not properly handle access control when dealing with RPC traffic through PMI2 and PMIx, which could allow an unprivileged user to send data to an arbitrary unix socket in the host. An attacker could possibly use this issue to execute arbitrary code as the root user. (CVE-2022-29501)

It was discovered that Slurm did not properly handle validation logic when processing input and output data with the srun client, which could lead to the interception of process I/O. An attacker could possibly use this issue to expose sensitive information or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-29502)