Title: EGI SVG ADVISORY [TLP:WHITE] CRITICAL risk vulnerability concerning
SLURM CVE-2017-15566 [EGI-SVG-CVE-2017-15566]
Date: 2017-11-02
Updated:
Affected software and risk
==========================
CRITICAL risk vulnerability concerning SLURM
Package : SLURM
CVE ID : CVE-2017-15566
A privilege escalation vulnerability is present in SLURM. [R 1] [R 2] [R 3]
Actions required/recommended
============================
Sites running SLURM should patch urgently if they have not done so already.
All running resources MUST be either patched or have mitigation in place or
software removed by 2017-11-10 00:00 UTC
Sites failing to act and/or failing to respond to requests from the EGI CSIRT
team risk site suspension.
Affected software details
=========================
SchedMD Slurm:--
before 16.05.11
17.x before 17.02.9
17.11.x before 17.11.0rc2
More information
================
There is a vulnerability in SLURM SPANK plugin that allows privilege escalation
to root via prolog/epilog scripts, no matter whether SPANK plugin is used or
not.
All SLURM installations that use prolog/epilog scripts are vulnerable.
See [R 1] [R 2] [R 3]
It has been noted that there are multiple EGI sites publishing vulnerable Slurm
versions through BDII.
Mitigation
==========
The only mitigation, aside from installing a patched version, is to disable
both Prolog and Epilog settings on your system and restart all slurmd
processes.
Component installation information
==================================
Sites running Debian should see [R 4]
Others should update using whatever method they usually use to install SLURM.
TLP and URL
===========
** WHITE information - Unlimited distribution - see
https://go.egi.eu/tlp for distribution restrictions **
URL: https://advisories.egi.eu/Advisory-SVG-CVE-2017-15566
Minor updates may be made without re-distribution to the sites
Comments
========
Comments or questions should be sent to svg-rat at mailman.egi.eu
If you find or become aware of another vulnerability which is relevant to EGI
you may report it by e-mail to
report-vulnerability at egi.eu
the EGI Software Vulnerability Group will take a look according to the
procedure defined in [R 5]
References
==========
[R 1] https://nvd.nist.gov/vuln/detail/CVE-2017-15566
[R 2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15566
[R 3] https://www.schedmd.com/news.php?id=193#OPT_193
[R 4] https://security-tracker.debian.org/tracker/CVE-2017-15566
[R 5] https://documents.egi.eu/public/ShowDocument?docid=2538
Credit
======
SVG was alerted to this vulnerability by Barbara Krasovec.
Timeline
========
Yyyy-mm-dd [EGI-SVG-2017-CVE-2017-15566]
2017-11-01 SVG alerted to this issue by Barbara Krasovec
2017-11-02 Acknowledgement from the EGI SVG to the reporter
2017-11-02 Investigation of vulnerability and relevance to EGI carried out by
SVG
2017-11-02 EGI SVG Risk Assessment completed
2017-11-02 Advisory sent to sites
Context
=======
This advisory has been prepared as part of the effort to fulfil EGI SVG's
purpose "To minimize the risk to the EGI infrastructure arising from software
vulnerabilities"
The risk is that assessed by the group, according to the EGI SVG issue handling
procedure [R 5] in the context of how the software is used in the EGI
infrastructure. It is the opinion of the group, we do not guarantee it to be
correct. The risk may also be higher or lower in other deployments depending
on how the software is used.
Others may re-use this information provided they:-
1) Respect the provided TLP classification
2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group
On behalf of the EGI SVG,