CVE-2023-49937

An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. Because of a double free, attackers can cause a denial of service or possibly execute arbitrary code. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.

These are all security issues fixed in the libnss_slurm2-23.02.7-1.1 package on the GA media of openSUSE Tumbleweed.

This update for slurm_20_02 fixes the following issues:

Security fixes:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm fixes the following issues:

Security fixes:

• CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)
• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_23_02 fixes the following issues:

Update to slurm 23.02.6:

Security fixes:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_22_05 fixes the following issues:

Update to slurm 22.05.11:

Security fixes:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm fixes the following issues:

Update to slurm 23.02.6:

Security fixes:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_22_05 fixes the following issues:

Update to slurm 22.05.11:

Security fixes:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm fixes the following issues:

Security fixes:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_20_11 fixes the following issues:

Security fixes:

• CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)
• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_23_02 fixes the following issues:

Update to slurm 23.02.6:

Security fixes:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_20_11 fixes the following issues:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_20_02 fixes the following issues:

Security fixes:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_22_05 fixes the following issues:

Update to slurm 22.05.11:

Security fixes:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_23_02 fixes the following issues:

Update to slurm 23.02.6:

Security fixes:

• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level MUNGE tokens and escalate permissions. (bsc#1218049)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm_18_08 fixes the following issues:

Security fixes:

• CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)
• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm fixes the following issues:

Security fixes:

• CVE-2023-41914: Prevent filesystem race conditions that could let an attacker take control of an arbitrary file, or remove entire directories' contents. (bsc#1216207)
• CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
• CVE-2023-49936: Prevent NULL pointer dereference on size_valp overflow. (bsc#1218050)
• CVE-2023-49937: Prevent double-xfree() on error in _unpack_node_reg_resp(). (bsc#1218051)
• CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053)

Other fixes:

• Add missing service file for slurmrestd (bsc#1217711).
• Fix slurm upgrading to incompatible versions (bsc#1216869).

This update for slurm fixes the following issues:

• CVE-2023-49933: Fixed a message extension attack that could bypass the message hash (bsc#1218046).
• CVE-2023-49936: Fixed a NULL pointer dereference (bsc#1218050).
• CVE-2023-49937: Fixed a double free that could lead to denial of service or code execution (bsc#1218051).
• CVE-2023-49938: Fixed an incorrect access control issue that could allow an attacker to modify their extended group list (bsc#1218053).

It was discovered that Slurm did not correctly handle certain file system operations. An attacker could possibly use this issue to modify files or leak sensitive information. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-41914)

Ryan Hall discovered that Slurm did not correctly enforce certain message integrity checks. An attacker could possibly use this issue to bypass integrity checks. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-49933)

Ryan Hall discovered that Slurm did not correctly handle certain memory operations. An attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-49937)

Ryan Hall discovered that Slurm did not correctly handle certain access control mechanisms. An attacker could possibly use this issue to modify files or leak sensitive information. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-49938)

It was discovered that Slurm did not correctly handle user promotion. An attacker could possibly use this issue to promote themselves to an administrator. (CVE-2025-43904)