Mailinglist Archive: opensuse-bugs (4250 mails)

< Previous Next >
[Bug 1018371] New: VUL-0: CVE-2016-10030: slurm: prolog failure vulnerability
  • From: bugzilla_noreply@xxxxxxxxxx
  • Date: Thu, 05 Jan 2017 15:56:41 +0000
  • Message-id: <bug-1018371-21960@http.bugzilla.opensuse.org/>
http://bugzilla.opensuse.org/show_bug.cgi?id=1018371


Bug ID: 1018371
Summary: VUL-0: CVE-2016-10030: slurm: prolog failure
vulnerability
Classification: openSUSE
Product: openSUSE.org
Version: unspecified
Hardware: Other
URL: https://smash.suse.de/issue/178269/
OS: Other
Status: NEW
Severity: Normal
Priority: P5 - None
Component: 3rd party software
Assignee: eich@xxxxxxxx
Reporter: astieger@xxxxxxxx
QA Contact: security-team@xxxxxxx
CC: burnus@xxxxxx, eich@xxxxxxxx, scorot@xxxxxxx
Found By: Security Response Team
Blocker: ---

network:cluster/slurm, not in the distribution

The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x
before
16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd
daemon informs users of a Prolog failure on a compute node. That vulnerability
could allow a user to assume control of an arbitrary file on the system. Any
exploitation of this is dependent on the user being able to cause or anticipate
the failure (non-zero return code) of a Prolog script that their job would run
on. This issue affects all Slurm versions from 0.6.0 (September 2005) to
present. Workarounds to prevent exploitation of this are to either disable your
Prolog script, or modify it such that it always returns 0 ("success") and
adjust
it to set the node as down using scontrol instead of relying on the slurmd to
handle that automatically. If you do not have a Prolog set you are unaffected
by
this issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-10030
https://www.schedmd.com/news.php?id=178
https://github.com/SchedMD/slurm/commit/92362a92fffe60187df61f99ab11c249d44120ee

--
You are receiving this mail because:
You are on the CC list for the bug.
< Previous Next >
This Thread
  • No further messages