SUSE-SU-2024:0283-1: Security update for slurm_22_05

Q: Which deployments are covered by this update?

The update applies to slurm_22_05 packages, including libslurm38 and libslurm38-debuginfo, on openSUSE Leap 15.3 and 15.5 and SUSE Linux Enterprise High Performance Computing LTSS 15 SP3. Listed architectures include aarch64, ppc64le, s390x, and x86_64, depending on the product.

Q: What security issues are addressed?

The update moves Slurm to 22.05.11 and addresses a message-extension attack that could bypass the message hash, a NULL pointer dereference caused by size_valp overflow, a double-free error while unpacking a node registration response, and modified sbcast RPCs opening files with incorrect group permissions.

Q: What additional operational fixes are included?

The update adds a missing service file for slurmrestd and fixes upgrades to incompatible Slurm versions.

Published Jan 31, 2024

Updated

This update for slurm2205 fixes the following issues: Update to slurm 22.05.11: Security fixes: CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046) CVE-2023-49936: Prevent NULL pointer dereference on sizevalp overflow. (bsc#1218050) CVE-2023-49937: Prevent double-xfree() on error in unpacknoderegresp(). (bsc#1218051) CVE-2023-49938: Prevent modified sbcast RPCs from opening a file with the wrong group permissions. (bsc#1218053) Other fixes: Add missing service file for slurmrestd (bsc#1217711). Fix slurm upgrading to incompatible versions (bsc#1216869).

Affected Software

20 affected componentsFixes available

All of the following

SUSE openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/libslurm38<22.05.11-150300.7.9.1

22.05.11-150300.7.9.1

suse/libslurm38-debuginfo<22.05.11-150300.7.9.1

22.05.11-150300.7.9.1

SUSE openSUSE Leap 15.3 (noarch)

All of the following

SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)

Any of the following

suse/libslurm38<22.05.11-150300.7.9.1

22.05.11-150300.7.9.1

suse/libslurm38-debuginfo<22.05.11-150300.7.9.1

22.05.11-150300.7.9.1

SUSE openSUSE Leap 15.5 (noarch)

All of the following

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64)

Any of the following

suse/libslurm38<22.05.11-150300.7.9.1

22.05.11-150300.7.9.1

suse/libslurm38-debuginfo<22.05.11-150300.7.9.1

22.05.11-150300.7.9.1

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (noarch)

All of the following

SUSE SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64)

Any of the following

suse/libslurm38<22.05.11-150300.7.9.1

22.05.11-150300.7.9.1

suse/libslurm38-debuginfo<22.05.11-150300.7.9.1

22.05.11-150300.7.9.1

SUSE SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch)

All of the following

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64)

Any of the following

suse/libslurm38<22.05.11-150300.7.9.1

22.05.11-150300.7.9.1

suse/libslurm38-debuginfo<22.05.11-150300.7.9.1

22.05.11-150300.7.9.1

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/libslurm38 to a version that resolves this vulnerability.
Fixed in 22.05.11-150300.7.9.1
Upgrade
Upgrade suse/libslurm38-debuginfo to a version that resolves this vulnerability.
Fixed in 22.05.11-150300.7.9.1
Upgrade
Upgrade slurm_22_05 to a version that resolves this vulnerability.
Fixed in 22.05.11
Configuration
Add the missing service file for slurmrestd.
slurmrestd service file = present

Event History

Jan 31, 2024

Advisory Published

via SUSE·12:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are covered by this update?

The update applies to slurm_22_05 packages, including libslurm38 and libslurm38-debuginfo, on openSUSE Leap 15.3 and 15.5 and SUSE Linux Enterprise High Performance Computing LTSS 15 SP3. Listed architectures include aarch64, ppc64le, s390x, and x86_64, depending on the product.

What security issues are addressed?

The update moves Slurm to 22.05.11 and addresses a message-extension attack that could bypass the message hash, a NULL pointer dereference caused by size_valp overflow, a double-free error while unpacking a node registration response, and modified sbcast RPCs opening files with incorrect group permissions.

What additional operational fixes are included?

The update adds a missing service file for slurmrestd and fixes upgrades to incompatible Slurm versions.

SUSE-SU-2024:0283-1: Security update for slurm_22_05

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are covered by this update?

What security issues are addressed?

What additional operational fixes are included?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are covered by this update?

What security issues are addressed?

What additional operational fixes are included?