Skip to content
OpenAdvisories
Medium SUSE-RU-2022:4297-1 5 CVEs

Recommended update for pdsh, slurm_22_05

Published Nov 30, 2022 · Updated Feb 4, 2026

Summary

This update for pdsh, slurm_22_05 fixes the following issues:

Slurm was updated to 22.05.5

- Fixes a number of moderate severity issues, noteable are:

* Load hash plugin at slurmstepd launch time to prevent issues loading the
plugin at step completion if the Slurm installation is upgraded.
* Update nvml plugin to match the unique id format for MIG devices in new
Nvidia drivers.
* Fix multi-node step launch failure when nodes in the controller aren't in
natural order. This can happen with inconsistent node naming (such as
node15 and node052) or with dynamic nodes which can register in any order.
* job_container/tmpfs - cleanup containers even when the .ns file isn't
mounted anymore.
* Wait up to PrologEpilogTimeout before shutting down slurmd to allow prolog
and epilog scripts to complete or timeout. Previously, slurmd waited 120
seconds before timing out and killing prolog and epilog scripts.

- Do not deduplicate files of testsuite Slurm configuration.
This directory is supposed to be mounted over /etc/slurm
therefore it must not contain softlinks to the files in
this directory.

- Fix a potential security vulnerability in the test package
(bsc#1201674, CVE-2022-31251).

- update to 22.05.2 with following fixes:

* Fix regression which allowed the oversubscription of licenses.
* Fix a segfault in slurmctld when requesting gres in job arrays.

- Allow log in as user 'slurm'. This allows admins to run certain
priviledged commands more easily without becoming root.

update to 22.05.0 with following changes:

- Support for dynamic node addition and removal
- Support for native Linux cgroup v2 operation
- Newly added plugins to support HPE Slingshot 11 networks
(switch/hpe_slingshot), and Intel Xe GPUs (gpu/oneapi)
- Added new acct_gather_interconnect/sysfs plugin to collect statistics
from arbitrary network interfaces.
- Expanded and synced set of environment variables available in the
Prolog/Epilog/PrologSlurmctld/EpilogSlurmctld scripts.
- New '--prefer' option to job submissions to allow for a 'soft
constraint' request to influence node selection.
- Optional support for license planning in the backfill scheduler with
'bf_licenses' option in SchedulerParameters.

- Add a comment about the CommunicationParameters=block_null_hash
option warning users who migrate - just in case.

- Update to 21.08.8 which fixes CVE-2022-29500 (bsc#1199278),
CVE-2022-29501 (bsc#1199279), and CVE-2022-29502 (bsc#1199281).

- Added 'CommunicationParameters=block_null_hash' to slurm.conf, please
add this parameter to existing configurations.

- Update to 21.08.7 with following changes:

* openapi/v0.0.37 - correct calculation for bf_queue_len_mean in /diag.
* Avoid shrinking a reservation when overlapping with downed nodes.
* Only check TRES limits against current usage for TRES requested by the job.
* Do not allocate shared gres (MPS) in whole-node allocations
* Constrain slurmstepd to job/step cgroup like in previous versions of Slurm.
* Fix warnings on 32-bit compilers related to printf() formats.
* Fix reconfigure issues after disabling/reenabling the GANG PreemptMode.
* Fix race condition where a cgroup was being deleted while another step
was creating it.
* Set the slurmd port correctly if multi-slurmd
* Fix FAIL mail not being sent if a job was cancelled due to preemption.
* slurmrestd - move debug logs for HTTP handling to be gated by debugflag
NETWORK to avoid unnecessary logging of communication contents.
* Fix issue with bad memory access when shrinking running steps.
* Fix various issues with internal job accounting with GRES when jobs are
shrunk.
* Fix ipmi polling on slurmd reconfig or restart.
* Fix srun crash when reserved ports are being used and het step fails
to launch.
* openapi/dbv0.0.37 - fix DELETE execution path on /user/{user_name}.
* slurmctld - Properly requeue all components of a het job if PrologSlurmctld
fails.
* rlimits - remove final calls to limit nofiles to 4096 but to instead use
the max possible nofiles in slurmd and slurmdbd.
* Allow the DBD agent to load large messages (up to MAX_BUF_SIZE) from state.
* Fix potential deadlock during slurmctld restart when there is a completing
job.
* slurmstepd - reduce user requested soft rlimits when they are above max
hard rlimits to avoid rlimit request being completely ignored and
processes using default limits.
* Fix Slurm user commands displaying available features as active features
when no features were active.
* Don't power down nodes that are rebooting.
* Clear pending node reboot on power down request.
* Ignore node registrations while node is powering down.
* Don't reboot any node that is power<ing|ed> down.
* Don't allow a node to reboot if it's marked for power down.
* Fix issuing reboot and downing when rebooting a powering up node.
* Clear DRAIN on node after failing to resume before ResumeTimeout.
* Prevent repeating power down if node fails to resume before ResumeTimeout.
* Fix federated cloud node communication with srun and cloud_dns.
* Fix jobs being scheduled on nodes marked to be powered_down when idle.
* Fix problem where a privileged user could not view array tasks specified by
<array_job_id>_<task_id> when PrivateData had the jobs value set.
- Changes in Slurm 21.08.6
* Fix plugin_name definitions in a number of plugins to improve logging.
* Close sbcast file transfers when job is cancelled.
* scrontab - fix handling of --gpus and --ntasks-per-gpu options.
* sched/backfill - fix job_queue_rec_t memory leak.
* Fix magnetic reservation logic in both main and backfill schedulers.
* job_container/tmpfs - fix memory leak when using InitScript.
* slurmrestd / openapi - fix memory leaks.
* Fix slurmctld segfault due to job array resv_list double free.
* Fix multi-reservation job testing logic.
* Fix slurmctld segfault due t

Fixed packages 10

ReleasePackageFixed in
openSUSE · Leap 15.3 pdsh_slurm_20_02 2.34-150100.10.14.1
openSUSE · Leap 15.4 pdsh_slurm_20_02 2.34-150100.10.14.1
SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-ESPOS pdsh 2.34-150100.10.14.1
SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-ESPOS pdsh_slurm_20_02 2.34-150100.10.14.1
SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-ESPOS pdsh_slurm_22_05 2.34-150100.10.14.1
SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-ESPOS slurm_22_05 22.05.5-150100.3.3.1
SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-LTSS pdsh 2.34-150100.10.14.1
SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-LTSS pdsh_slurm_20_02 2.34-150100.10.14.1
SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-LTSS pdsh_slurm_22_05 2.34-150100.10.14.1
SUSE · SLE HPC 15 SP1 Linux Enterprise High Performance Computing 15 SP1-LTSS slurm_22_05 22.05.5-150100.3.3.1

Vulnerabilities 5

  • Medium 6.5

    slurm: %post for slurm-testsuite operates as root in user owned directory

    A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE Factory slurm versions prior to 22.05.2-3.3.

  • Unscored —

    SchedMD Slurm 21.08.* before 21.08.4 has Incorrect Access Control. On sites using the new AccountingStoreFlags=job_scri…

  • Unscored —

    SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Information Disclosure.

  • Unscored —

    SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges and code exec…

  • Unscored —

    SchedMD Slurm 21.08.x through 20.11.x has Incorrect Access Control that leads to Escalation of Privileges.

References

  • web
    https://www.suse.com/security/cve/CVE-2021-43337
  • web
    https://www.suse.com/security/cve/CVE-2022-29500
  • web
    https://www.suse.com/security/cve/CVE-2022-29501
  • web
    https://www.suse.com/security/cve/CVE-2022-29502
  • web
    https://www.suse.com/security/cve/CVE-2022-31251