CVE-2023-49934
📋 TL;DR
This SQL injection vulnerability in SchedMD Slurm 23.11.x allows attackers to execute arbitrary SQL commands against the SlurmDBD database. Organizations running affected Slurm versions are at risk of data manipulation, exfiltration, or potential privilege escalation. The vulnerability affects Slurm workload manager installations with SlurmDBD enabled.
💻 Affected Systems
- SchedMD Slurm
📦 What is this software?
Slurm by Schedmd
Slurm by Schedmd
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the SlurmDBD database leading to data exfiltration, privilege escalation to root, and potential lateral movement to other systems in the cluster.
Likely Case
Unauthorized access to sensitive job data, user information, and potential manipulation of accounting records or job scheduling.
If Mitigated
Limited impact if proper network segmentation, database permissions, and input validation are already in place.
🎯 Exploit Status
SQL injection vulnerabilities typically have low exploitation complexity, but specific exploit details haven't been publicly disclosed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.11.1
Vendor Advisory: https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html
Restart Required: Yes
Instructions:
1. Download Slurm 23.11.1 from official sources. 2. Stop Slurm services. 3. Apply the patch or upgrade to 23.11.1. 4. Restart Slurm services including slurmdbd.
🔧 Temporary Workarounds
Disable SlurmDBD
linuxTemporarily disable the Slurm database daemon if not critically needed
systemctl stop slurmdbd
systemctl disable slurmdbd
Network isolation
linuxRestrict network access to SlurmDBD port (typically 6819)
iptables -A INPUT -p tcp --dport 6819 -j DROP
firewall-cmd --permanent --remove-port=6819/tcp
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to SlurmDBD
- Enable database-level security controls and audit logging for all SQL queries
🔍 How to Verify
Check if Vulnerable:
Check Slurm version: slurmdbd --version | grep '23.11.0'Check Version:
slurmdbd --versionVerify Fix Applied:
Verify version is 23.11.1 or later: slurmdbd --version📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in SlurmDBD logs
- Multiple failed authentication attempts
- Unexpected database connections
Network Indicators:
- Unusual traffic patterns to port 6819
- SQL injection patterns in network traffic
SIEM Query:
source="slurmdbd.log" AND ("SELECT" OR "INSERT" OR "UPDATE" OR "DELETE") AND NOT normal_query_pattern🔗 References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
- https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html
- https://www.schedmd.com/security-archive.php
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/63FEDDYEE2WK7FHWBHKON3OZVQI56WSQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AYQS3LFGC4HE4WCW4L3NAA2I6FRIWMNO/
- https://lists.schedmd.com/pipermail/slurm-announce/2023/000103.html
- https://www.schedmd.com/security-archive.php
