// For flags

CVE-2023-49935

Gentoo Linux Security Advisory 202409-16

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. There is Incorrect Access Control because of a slurmd Message Integrity Bypass. An attacker can reuse root-level authentication tokens during interaction with the slurmd process. This bypasses the RPC message hashes that protect against undesired MUNGE credential reuse. The fixed versions are 23.02.7 and 23.11.1.

Se descubrió un problema en SchedMD Slurm 23.02.x y 23.11.x. Hay un control de acceso incorrecto debido a una omisión de integridad de mensajes lenta. Un atacante puede reutilizar tokens de autenticación de nivel raíz durante la interacción con el proceso slurmd. Esto omite los hashes de mensajes RPC que protegen contra la reutilización no deseada de credenciales MUNGE. Las versiones fijas son 23.02.7 y 23.11.1.

Multiple vulnerabilities have been discovered in Slurm, the worst of which could result in privilege escalation or code execution. Versions less than or equal to 22.05.3 are affected.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-03 CVE Reserved
  • 2023-12-14 CVE Published
  • 2024-08-02 CVE Updated
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-613: Insufficient Session Expiration
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Schedmd
Search vendor "Schedmd"
 Slurm
Search vendor "Schedmd" for product "Slurm"
 >= 23.02 < 23.02.7
Search vendor "Schedmd" for product "Slurm" and version " >= 23.02 < 23.02.7"
-
Affected
Schedmd
Search vendor "Schedmd"
 Slurm
Search vendor "Schedmd" for product "Slurm"
 23.11
Search vendor "Schedmd" for product "Slurm" and version "23.11"
-
Affected
Schedmd
Search vendor "Schedmd"
 Slurm
Search vendor "Schedmd" for product "Slurm"
 23.11
Search vendor "Schedmd" for product "Slurm" and version "23.11"
rc1
Affected