CVE-2009-2084: High severity llnl SLURM vulnerability
Published Jun 16, 2009
·Updated
Simple Linux Utility for Resource Management (SLURM) 1.2 and 1.3 before 1.3.14 does not properly set supplementary groups before invoking (1) sbcast from the slurmd daemon or (2) strigger from the slurmctld daemon, which might allow local SLURM users to modify files and gain privileges.
Affected Software
15 affected components
llnl SLURM<=1.3.13
llnl SLURM=1.2
llnl SLURM=1.3
llnl SLURM=1.3.1
llnl SLURM=1.3.2
llnl SLURM=1.3.3
llnl SLURM=1.3.4
llnl SLURM=1.3.5
llnl SLURM=1.3.6
llnl SLURM=1.3.7
llnl SLURM=1.3.8
llnl SLURM=1.3.9
llnl SLURM=1.3.10
llnl SLURM=1.3.11
llnl SLURM=1.3.12
Remediation
Patch Available
Patch Available
Patch Available
Event History
Jun 16, 2009
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2084?
CVE-2009-2084 is considered to have a medium severity due to the potential for privilege escalation.
2
How do I fix CVE-2009-2084?
To fix CVE-2009-2084, upgrade SLURM to version 1.3.14 or later.
3
What versions of SLURM are affected by CVE-2009-2084?
CVE-2009-2084 affects SLURM versions 1.2, 1.3, and all versions up to 1.3.13.
4
What vulnerabilities does CVE-2009-2084 exploit?
CVE-2009-2084 exploits improper setting of supplementary groups in the sbcast and strigger operations.
5
Who can exploit CVE-2009-2084?
Local SLURM users could exploit CVE-2009-2084 to modify files and gain additional privileges.