An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of     a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during     interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired     MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1. (CVE-2023-49935)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202409-16 (Slurm: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Slurm. Please review the CVE identifiers referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0312-1 advisory.

    Update to slurm 23.02.6:

    Security fixes:

    - CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
    - CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level     MUNGE tokens and escalate permissions. (bsc#1218049)
    - CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)
    - CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)
    - CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions.
    (bsc#1218053)

    Other fixes:

    - Add missing service file for slurmrestd (bsc#1217711).
    - Fix slurm upgrading to incompatible versions (bsc#1216869).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0289-1 advisory.

    Update to slurm 23.02.6:

    Security fixes:

    - CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
    - CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level     MUNGE tokens and escalate permissions. (bsc#1218049)
    - CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)
    - CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)
    - CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions.
    (bsc#1218053)

    Other fixes:

    - Add missing service file for slurmrestd (bsc#1217711).
    - Fix slurm upgrading to incompatible versions (bsc#1216869).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0284-1 advisory.

    Update to slurm 23.02.6:

    Security fixes:

    - CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
    - CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level     MUNGE tokens and escalate permissions. (bsc#1218049)
    - CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)
    - CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)
    - CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions.
    (bsc#1218053)

    Other fixes:

    - Add missing service file for slurmrestd (bsc#1217711).
    - Fix slurm upgrading to incompatible versions (bsc#1216869).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0280-1 advisory.

    Update to slurm 23.02.6:

    Security fixes:

    - CVE-2023-49933: Prevent message extension attacks that could bypass the message hash. (bsc#1218046)
    - CVE-2023-49935: Prevent message hash bypass in slurmd which can allow an attacker to reuse root-level     MUNGE tokens and escalate permissions. (bsc#1218049)
    - CVE-2023-49936: Prevent NULL pointer dereference on `size_valp` overflow. (bsc#1218050)
    - CVE-2023-49937: Prevent double-xfree() on error in `_unpack_node_reg_resp()`. (bsc#1218051)
    - CVE-2023-49938: Prevent modified `sbcast` RPCs from opening a file with the wrong group permissions.
    (bsc#1218053)

    Other fixes:

    - Add missing service file for slurmrestd (bsc#1217711).
    - Fix slurm upgrading to incompatible versions (bsc#1216869).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-9a74d212f8 advisory.

    - Update to 22.05.11
    - Closes CVE-2023-49933 through CVE-2023-49938

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-540de58d84 advisory.

    - Update to 22.05.11
    - Closes CVE-2023-49933 through CVE-2023-49938

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 76c2110b-9e97-11ee-ae23-a0f3c100ae18 advisory.

  - An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. There is Improper Enforcement of     Message Integrity During Transmission in a Communication Channel. This allows attackers to modify RPC     traffic in a way that bypasses message hash checks. The fixed versions are 22.05.11, 23.02.7, and 23.11.1.
    (CVE-2023-49933)

  - An issue was discovered in SchedMD Slurm 23.11.x. There is SQL Injection against the SlurmDBD database.
    The fixed version is 23.11.1. (CVE-2023-49934)

  - An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of     a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during     interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired     MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1. (CVE-2023-49935)

  - An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. A NULL pointer dereference leads     to denial of service. The fixed versions are 22.05.11, 23.02.7, and 23.11.1. (CVE-2023-49936)

  - An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. Because of a double free,     attackers can cause a denial of service or possibly execute arbitrary code. The fixed versions are     22.05.11, 23.02.7, and 23.11.1. (CVE-2023-49937)

  - An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. There is Incorrect Access Control: an     attacker can modified their extended group list that is used with the sbcast subsystem, and open files     with an unauthorized set of extended groups. The fixed versions are 22.05.11 and 23.02.7. (CVE-2023-49938)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
250736	Linux Distros Unpatched Vulnerability : CVE-2023-49935	Nessus	Misc.	high
207577	GLSA-202409-16 : Slurm: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
189958	SUSE SLES12: libnss_slurm2_23_02 / libpmi0_23_02 / libslurm39 / perl-slurm_23_02 / etc (SUSE-SU-2024:0312-1)	Nessus	SuSE Local Security Checks	critical
189888	SUSE SLES15: libnss_slurm2_23_02 / libpmi0_23_02 / libslurm39 / perl-slurm_23_02 / etc (SUSE-SU-2024:0289-1)	Nessus	SuSE Local Security Checks	critical
189885	SUSE SLES15: libnss_slurm2 / libpmi0 / libslurm39 / perl-slurm / slurm / etc (SUSE-SU-2024:0284-1)	Nessus	SuSE Local Security Checks	critical
189882	SUSE SLES15: libnss_slurm2_23_02 / libpmi0_23_02 / libslurm39 / perl-slurm_23_02 / etc (SUSE-SU-2024:0280-1)	Nessus	SuSE Local Security Checks	critical
187488	Fedora 39 : slurm (2023-9a74d212f8)	Nessus	Fedora Local Security Checks	critical
187487	Fedora 38 : slurm (2023-540de58d84)	Nessus	Fedora Local Security Checks	critical
187103	FreeBSD : slurm-wlm -- Several security issues (76c2110b-9e97-11ee-ae23-a0f3c100ae18)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2023-49935

high

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

critical

critical