Description
The tm_adopt function in lib/Libifl/tm.c in Terascale Open-Source Resource and Queue Manager (aka TORQUE Resource Manager) 5.0.x, 4.5.x, 4.2.x, and earlier does not validate that the owner of the process also owns the adopted session id, which allows remote authenticated users to kill arbitrary processes via a crafted executable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | torque | 2.4.16+dfsg-1+deb7u4 | DSA-3058-1 |
| Debian 6.0 | torque | 2.4.8+dfsg-9squeeze5 | DLA-78-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | torque | 2.4.16+dfsg-1.3ubuntu1.1 | — |
Advisories 2
- DLA-78-1 torque - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3058-1 torque - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2015-8577 vendor-advisory
- [oss-security] 20141003 Re: tm_adopt() vulnerability in TORQUE Resource Manager mailing-list
- http://advisories.mageia.org/MGASA-2014-0408.html
- FEDORA-2015-8544 vendor-advisory
- 61960 third-party-advisory
- FEDORA-2015-8571 vendor-advisory
- DSA-3058 vendor-advisory
- MDVSA-2015:124 vendor-advisory
- [oss-security] 20141002 tm_adopt() vulnerability in TORQUE Resource Manager mailing-list
- 61350 third-party-advisory