CVE-2024-48936: Medium severity slurm workload manager vulnerability
SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit an attacker to execute processes under other users' jobs. This is limited to jobs explicitly running with --stepmgr, or on systems that have globally enabled stepmgr via SlurmctldParameters=enablestepmgr in their configuration.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-48936?
CVE-2024-48936 is classified as having a high severity due to its potential to allow unauthorized process execution under different user jobs.
How do I fix CVE-2024-48936?
To remediate CVE-2024-48936, update SchedMD Slurm to version 24.05.4 or later.
What versions of SchedMD Slurm are affected by CVE-2024-48936?
CVE-2024-48936 affects all versions of SchedMD Slurm prior to 24.05.4.
What type of vulnerability is CVE-2024-48936?
CVE-2024-48936 is an Incorrect Authorization vulnerability within the stepmgr component of SchedMD Slurm.
Can CVE-2024-48936 be exploited remotely?
CVE-2024-48936 requires local access or specific configurations, as it is limited to jobs that are explicitly running with the --stepmgr option.