CVE-2019-19728
📋 TL;DR
This vulnerability in SchedMD Slurm allows local users to execute the 'srun --uid' command with incorrect privileges, potentially enabling privilege escalation. It affects Slurm installations before version 18.08.9 and 19.x before 19.05.5. Users with local access to Slurm systems are at risk.
💻 Affected Systems
- SchedMD Slurm
📦 What is this software?
Leap by Opensuse
Slurm by Schedmd
Slurm by Schedmd
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to root, allowing complete system compromise and potential lateral movement across the cluster.
Likely Case
Unauthorized privilege escalation within the Slurm environment, enabling users to execute jobs with higher privileges than intended.
If Mitigated
Limited impact if proper access controls and monitoring are in place, with potential for job execution anomalies.
🎯 Exploit Status
Exploitation requires local user access to execute the srun command with specific parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.08.9 or 19.05.5 and later
Vendor Advisory: https://lists.schedmd.com/pipermail/slurm-announce/
Restart Required: Yes
Instructions:
1. Download and install Slurm version 18.08.9 or 19.05.5 from official sources. 2. Stop Slurm services. 3. Apply the update. 4. Restart Slurm services. 5. Verify the update was successful.
🔧 Temporary Workarounds
Restrict srun command usage
linuxLimit which users can execute srun with --uid parameter through Slurm configuration
# Configure in slurm.conf to restrict srun usage
# Set appropriate PartitionName and AllowGroups parameters
🧯 If You Can't Patch
- Implement strict access controls to limit which users can execute srun commands
- Monitor and audit all srun --uid executions for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Slurm version with 'slurmd --version' or 'srun --version' and compare against vulnerable versionsCheck Version:
slurmd --versionVerify Fix Applied:
Verify version is 18.08.9 or higher for 18.x branch, or 19.05.5 or higher for 19.x branch📡 Detection & Monitoring
Log Indicators:
- Unusual srun --uid executions
- Privilege escalation attempts in Slurm logs
- Job submissions with unexpected user IDs
Network Indicators:
- Unusual job submission patterns from specific users
SIEM Query:
source="slurm" AND ("srun --uid" OR "privilege escalation")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00038.html
- https://bugzilla.suse.com/show_bug.cgi?id=1159692
- https://lists.schedmd.com/pipermail/slurm-announce/
- https://www.debian.org/security/2021/dsa-4841
- https://www.schedmd.com/news.php
- http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00038.html
- https://bugzilla.suse.com/show_bug.cgi?id=1159692
- https://lists.schedmd.com/pipermail/slurm-announce/
- https://www.debian.org/security/2021/dsa-4841
- https://www.schedmd.com/news.php
