Slurm (slurmdbd, sacctmgr archive load): MULTI-TENANT ISOLATION: A second SQL injection path into SlurmDBD, this one

Impact

MULTI-TENANT ISOLATION: A second SQL injection path into SlurmDBD, this one through the 'sacctmgr archive load' path where strings were not escaped before hitting the database. Same consequence as the 2018 injection - arbitrary read and write of the accounting database that defines account membership, QOS caps and fairshare, which is the data structure the scheduler uses to decide whose jobs get GPUs.

Who can reach it

Anything that can reach the slurmdbd RPC port, typically the login nodes and the controller. The archive-load path is what an operator or an account coordinator invokes to reload archived accounting data.

What to do

Upgrade to Slurm 18.08.8 or 19.05.1 and restart slurmdbd. SchedMD published fixes only for the then-supported 18.08 and 19.05 lines and warned that earlier versions carry similar flaws with no patch, so anything older has to move forward. Restrict slurmdbd's listener to the controller and admin hosts rather than the whole login-node subnet while you are in there.

References