Difference between revisions of "SVG:Advisory-SVG-CVE-2017-15566"
Jump to navigation
Jump to search
(Created page with "{{svg-header}} <pre> Title: EGI SVG ADVISORY [TLP:WHITE] CRITICAL risk vulnerability concerning SLURM CVE-2017-15566 [EGI-SVG-CVE-2017-15566] Date: 2017-1...") |
imported>Cornwall (Created page with "{{svg-header}} <pre> Title: EGI SVG ADVISORY [TLP:WHITE] CRITICAL risk vulnerability concerning SLURM CVE-2017-15566 [EGI-SVG-CVE-2017-15566] Date: 2017-1...") |
(No difference)
|
Revision as of 16:02, 2 November 2017
Main page | Software Security Checklist | Issue Handling | Advisories | Notes On Risk | Advisory Template | More |
Advisory-SVG-CVE-2017-15566
Title: EGI SVG ADVISORY [TLP:WHITE] CRITICAL risk vulnerability concerning SLURM CVE-2017-15566 [EGI-SVG-CVE-2017-15566] Date: 2017-11-02 Updated: Affected software and risk ========================== CRITICAL risk vulnerability concerning SLURM Package : SLURM CVE ID : CVE-2017-15566 A privilege escalation vulnerability is present in SLURM. [R 1] [R 2] [R 3] Actions required/recommended ============================ Sites running SLURM should patch urgently if they have not done so already. All running resources MUST be either patched or have mitigation in place or software removed by 2017-11-10 00:00 UTC Sites failing to act and/or failing to respond to requests from the EGI CSIRT team risk site suspension. Affected software details ========================= SchedMD Slurm:-- before 16.05.11 17.x before 17.02.9 17.11.x before 17.11.0rc2 More information ================ There is a vulnerability in SLURM SPANK plugin that allows privilege escalation to root via prolog/epilog scripts, no matter whether SPANK plugin is used or not. All SLURM installations that use prolog/epilog scripts are vulnerable. See [R 1] [R 2] [R 3] It has been noted that there are multiple EGI sites publishing vulnerable Slurm versions through BDII. Mitigation ========== The only mitigation, aside from installing a patched version, is to disable both Prolog and Epilog settings on your system and restart all slurmd processes. Component installation information ================================== Sites running Debian should see [R 4] Others should update using whatever method they usually use to install SLURM. TLP and URL =========== ** WHITE information - Unlimited distribution - see https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions*** URL: https://wiki.egi.eu/wiki/SVG:Advisory-SVG-CVE-2017-15566 Minor updates may be made without re-distribution to the sites Comments ======== Comments or questions should be sent to svg-rat at mailman.egi.eu If you find or become aware of another vulnerability which is relevant to EGI you may report it by e-mail to report-vulnerability at egi.eu the EGI Software Vulnerability Group will take a look according to the procedure defined in [R 5] References ========== [R 1] https://nvd.nist.gov/vuln/detail/CVE-2017-15566 [R 2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15566 [R 3] https://www.schedmd.com/news.php?id=193#OPT_193 [R 4] https://security-tracker.debian.org/tracker/CVE-2017-15566 [R 5] https://documents.egi.eu/public/ShowDocument?docid=2538 Credit ====== SVG was alerted to this vulnerability by Barbara Krasovec. Timeline ======== Yyyy-mm-dd [EGI-SVG-2017-CVE-2017-15566] 2017-11-01 SVG alerted to this issue by Barbara Krasovec 2017-11-02 Acknowledgement from the EGI SVG to the reporter 2017-11-02 Investigation of vulnerability and relevance to EGI carried out by SVG 2017-11-02 EGI SVG Risk Assessment completed 2017-11-02 Advisory sent to sites Context ======= This advisory has been prepared as part of the effort to fulfil EGI SVG's purpose "To minimize the risk to the EGI infrastructure arising from software vulnerabilities" The risk is that assessed by the group, according to the EGI SVG issue handling procedure [R 5] in the context of how the software is used in the EGI infrastructure. It is the opinion of the group, we do not guarantee it to be correct. The risk may also be higher or lower in other deployments depending on how the software is used. Others may re-use this information provided they:- 1) Respect the provided TLP classification 2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group On behalf of the EGI SVG,