SB2023103050 - Ubuntu update for slurm-llnl

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Improper access control (CVE-ID: CVE-2022-29500)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can obtain sensitive information credentials for the SlurmUser account.

2) Improper access control (CVE-ID: CVE-2022-29501)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in a network RPC handler in the slurmd daemon used for PMI2 and PMIx support. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.

3) Improper access control (CVE-ID: CVE-2022-29502)

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in the I/O key validation logic in the srun client command. A remote attacker can bypass implemented security restrictions and gain elevated privileges on the system.

Remediation

Install update from vendor's website.

References

• https://ubuntu.com/security/notices/USN-6458-1