Slurm (slurmdbd accounting database daemon): SQL injection into SlurmDBD gives an attacker read and write control of

Impact

SQL injection into SlurmDBD gives an attacker read and write control of the cluster's accounting database - the record of which account owns which job, which associations exist, and what fairshare and QOS limits apply. Rewriting associations is how you grant yourself submission rights to another tenant's account, and the same database is what billing and chargeback are computed from.

Who can reach it

Anything that can send RPCs to the slurmdbd port. In most sites slurmdbd is reachable from the login nodes and from slurmctld, so a tenant with a shell on a login node is in position.

What to do

Upgrade Slurm to 17.02.10 or 17.11.5 and restart slurmdbd. slurmdbd can be restarted independently of slurmctld and running jobs survive it, so this does not need a maintenance window. Audit the assoc and user tables afterwards - the injection leaves no distinctive log line.

References