HTCondor (condor_schedd / Access Point): MULTI-TENANT ISOLATION: A user plants a specially crafted job that lies

Impact

MULTI-TENANT ISOLATION: A user plants a specially crafted job that lies dormant, then runs as a different non-root user of the attacker's choosing once the Access Point is upgraded to an affected version. The upgrade itself is the trigger, which makes this an unusually nasty one to reason about - the exploit is armed before you install the vulnerable code.

Who can reach it

A user with WRITE access to the schedd, i.e. anyone allowed to submit jobs, on an AP running 24.7.3 or later.

What to do

Upgrade to HTCondor 24.12.14, 25.0.3 or 25.3.1. Before and after the upgrade, hunt for pre-planted jobs with: condor_q -all -constraint 'OsUser != Owner' and condor_rm anything suspicious. An AP already running a vulnerable version cannot have a new attack initiated against it, so the priority order is: scan the queue, then upgrade.

References