CVE-2023-49935: High severity SchedMD Slurm vulnerability
An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-49935?
CVE-2023-49935 has a high severity due to incorrect access control that allows attackers to reuse root-level authentication tokens.
How do I mitigate CVE-2023-49935?
To mitigate CVE-2023-49935, upgrade to a patched version of SchedMD Slurm that addresses the message integrity bypass issue.
What versions of SchedMD Slurm are affected by CVE-2023-49935?
CVE-2023-49935 affects SchedMD Slurm versions 23.02.x and 23.11.x.
Can CVE-2023-49935 be exploited remotely?
Yes, CVE-2023-49935 can be exploited by remote attackers who can interact with the slurmd process.
What are the consequences of exploiting CVE-2023-49935?
Exploiting CVE-2023-49935 can lead to unauthorized access to system privileges and control over the Slurm workload manager.