CVE-2023-41914

SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or deleting files.

These are all security issues fixed in the libnss_slurm2-23.02.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. (bsc#1216207)

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. (bsc#1216207)

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. (bsc#1216207)

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed several filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file (bsc#1216207).

Non-security fixes:

• Fixed dependency issues that could arise during an upgrade (bsc#1208810).

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. (bsc#1216207)

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. (bsc#1216207)

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. (bsc#1216207)

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. (bsc#1216207)

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. (bsc#1216207)

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could lead to an attacker taking control of an arbitrary file. (bsc#1216207)

This update for slurm_23_02 fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could have led to an attacker taking control of an arbitrary file, or removing entire directoy contents (bsc#1216207).

Bug fixes:

• Add missing dependencies to slurm-config to plugins package. These should help to tie down the slurm version and help to avoid a package mix (bsc#1216869).

This update for slurm_23_02 fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could have led to an attacker taking control of an arbitrary file, or removing entire directoy contents (bsc#1216207).

Bug fixes:

• Add missing dependencies to slurm-config to plugins package. These should help to tie down the slurm version and help to avoid a package mix (bsc#1216869).

This update for slurm_23_02 fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could have led to an attacker taking control of an arbitrary file, or removing entire directoy contents (bsc#1216207).

Bug fixes:

• Add missing dependencies to slurm-config to plugins package. These should help to tie down the slurm version and help to avoid a package mix (bsc#1216869).

This update for slurm_23_02 fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could have led to an attacker taking control of an arbitrary file, or removing entire directoy contents (bsc#1216207).

Bug fixes:

• Add missing dependencies to slurm-config to plugins package. These should help to tie down the slurm version and help to avoid a package mix (bsc#1216869).

This update for slurm fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race conditions that could have led to an attacker taking control of an arbitrary file, or removing entire directoy contents (bsc#1216207).

Bug fixes:

• Add missing dependencies to slurm-config to plugins package. These should help to tie down the slurm version and help to avoid a package mix (bsc#1216869).

This update for slurm_22_05 fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race condition that could have led to an attacker taking control of an arbitrary file, or removing entire directory contents (bsc#1216207).

Bug fixes:

• Add missing dependencies to slurm-config to plugins package. These should help to tie down the slurm version and help to avoid a package mix (bsc#1216869).
• Add missing Provides:, Conflicts: and Obsoletes: to slurm-cray, slurm-hdf5 and slurm-testsuite to avoid package conflicts (bsc#1208810).

This update for slurm_22_05 fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race condition that could have led to an attacker taking control of an arbitrary file, or removing entire directory contents (bsc#1216207).

Bug fixes:

• Add missing dependencies to slurm-config to plugins package. These should help to tie down the slurm version and help to avoid a package mix (bsc#1216869).
• Add missing Provides:, Conflicts: and Obsoletes: to slurm-cray, slurm-hdf5 and slurm-testsuite to avoid package conflicts (bsc#1208810).

This update for slurm_22_05 fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race condition that could have led to an attacker taking control of an arbitrary file, or removing entire directory contents (bsc#1216207).

Bug fixes:

• Add missing dependencies to slurm-config to plugins package. These should help to tie down the slurm version and help to avoid a package mix (bsc#1216869).
• Add missing Provides:, Conflicts: and Obsoletes: to slurm-cray, slurm-hdf5 and slurm-testsuite to avoid package conflicts (bsc#1208810).

This update for slurm_22_05 fixes the following issues:

• CVE-2023-41914: Fixed a filesystem handling race condition that could have led to an attacker taking control of an arbitrary file, or removing entire directory contents (bsc#1216207).

Bug fixes:

• Add missing dependencies to slurm-config to plugins package. These should help to tie down the slurm version and help to avoid a package mix (bsc#1216869).
• Add missing Provides:, Conflicts: and Obsoletes: to slurm-cray, slurm-hdf5 and slurm-testsuite to avoid package conflicts (bsc#1208810).

This update for slurm fixes the following issues:

Security fixes:

• CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)
• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_20_11 fixes the following issues:

Security fixes:

• CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)
• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_20_11 fixes the following issues:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_18_08 fixes the following issues:

Security fixes:

• CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)
• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm fixes the following issues:

Security fixes:

• CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)
• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

It was discovered that Slurm did not correctly handle certain file system operations. An attacker could possibly use this issue to modify files or leak sensitive information. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-41914)

Ryan Hall discovered that Slurm did not correctly enforce certain message integrity checks. An attacker could possibly use this issue to bypass integrity checks. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-49933)

Ryan Hall discovered that Slurm did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-49937)

Ryan Hall discovered that Slurm did not correctly handle certain access control mechanisms. An attacker could possibly use this issue to modify files or leak sensitive information. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-49938)

It was discovered that Slurm did not correctly handle user promotion. An attacker could possibly use this issue to promote themselves to an administrator. (CVE-2025-43904)