Description
Simple Linux Utility for Resource Management (SLURM) 1.2 and 1.3 before 1.3.14 does not properly set supplementary groups before invoking (1) sbcast from the slurmd daemon or (2) strigger from the slurmctld daemon, which might allow local SLURM users to modify files and gain privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | slurm-llnl | 1.3.6-1lenny3 | DSA-1776-1 |
Advisories 1
- DSA-1776-1 slurm-llnl - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- slurm-sbcast-priv-escalation(50126) vdb-entry
- ADV-2009-1128 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=524980
- 34831 third-party-advisory
- http://sourceforge.net/project/shownotes.php?release_id=676055&group_id=157944
- slurm-slurmctld-privilege-escalation(50127) vdb-entry
- 34638 vdb-entry
- DSA-1776 vendor-advisory