An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade slurm-wlm | Jul 27, 2026 | Jul 27, 2026 |
| Freebsd | — | Upgrade slurm-wlm | Dec 20, 2023 | Dec 19, 2023 |
| Gentoo Linux | — | Upgrade sys-cluster/slurm. | Sep 23, 2024 | Dec 14, 2023 |
| Suse | — | Upgrade slurm-restUpgrade libnss_slurm2Upgrade slurm_23_02-develUpgrade slurm_23_02-luaUpgrade perl-slurm_23_02Upgrade slurm_23_02-pam_slurmUpgrade slurm-plugin-ext-sensors-rrdUpgrade slurm-slurmdbdUpgrade slurm_23_02-pluginsUpgrade slurm-config-manUpgrade slurm-mungeUpgrade slurm-hdf5Upgrade perl-slurmUpgrade libslurm39Upgrade slurm_23_02-mungeUpgrade slurm_23_02-configUpgrade slurm_23_02-torqueUpgrade slurm-develUpgrade slurm_23_02-docUpgrade slurm-auth-noneUpgrade libpmi0_23_02Upgrade slurm_23_02-slurmdbdUpgrade slurm-pam_slurmUpgrade slurm-sjstatUpgrade slurm_23_02-sqlUpgrade slurm-testsuiteUpgrade slurm_23_02-crayUpgrade slurm-openlavaUpgrade slurm_23_02-auth-noneUpgrade slurm-sviewUpgrade slurm-luaUpgrade slurm_23_02-sviewUpgrade slurm_23_02Upgrade slurm-sqlUpgrade slurm-webdocUpgrade slurm-seffUpgrade libnss_slurm2_23_02Upgrade slurm-nodeUpgrade slurm-docUpgrade slurm_23_02-nodeUpgrade slurm_23_02-plugin-ext-sensors-rrdUpgrade slurm-torqueUpgrade slurm-crayUpgrade slurm-pluginsUpgrade slurm_23_02-config-manUpgrade libpmi0Upgrade slurm-configUpgrade slurm_23_02-webdocUpgrade slurm | Feb 1, 2024 | Dec 14, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub