SVG:Advisory-SVG-CVE-2017-15566

Main page

Software Security Checklist

Issue Handling

Advisories

Notes On Risk

Advisory Template

More

---

Advisory-SVG-CVE-2017-15566

Title:   EGI SVG ADVISORY [TLP:WHITE] CRITICAL risk vulnerability concerning SLURM 
          CVE-2017-15566  [EGI-SVG-CVE-2017-15566] 

Date:        2017-11-02
Updated:     


Affected software and risk
==========================

CRITICAL risk vulnerability concerning SLURM

Package : SLURM
CVE ID  : CVE-2017-15566

A privilege escalation vulnerability is present in SLURM.  [R 1] [R 2] [R 3]

Actions required/recommended
============================

Sites running SLURM should patch urgently if they have not done so already. 

All running resources MUST be either patched  or have mitigation in place or software 
removed by 2017-11-10  00:00 UTC

Sites failing to act and/or failing to respond to requests from the EGI CSIRT team risk site suspension. 


Affected software details
=========================

SchedMD Slurm:-- 

before 16.05.11

17.x before 17.02.9 

17.11.x before 17.11.0rc2


More information
================

There is a vulnerability in SLURM SPANK plugin that allows privilege escalation to 
root via prolog/epilog scripts, no matter whether SPANK plugin is used or not. 
All SLURM installations that use prolog/epilog scripts are vulnerable. 

See [R 1] [R 2] [R 3]

It has been noted that there are multiple EGI sites publishing vulnerable Slurm 
versions through BDII. 


Mitigation
==========

The only mitigation, aside from installing a patched version, is to disable both 
Prolog and Epilog settings on your system and restart all slurmd processes.


Component installation information
==================================

Sites running Debian should see [R 4]

Others should update using whatever method they usually use to install SLURM.

TLP and URL
===========

** WHITE information - Unlimited distribution - see 
https://wiki.egi.eu/wiki/EGI_CSIRT:TLP for distribution restrictions***               
        
URL:   https://wiki.egi.eu/wiki/SVG:Advisory-SVG-CVE-2017-15566   

Minor updates may be made without re-distribution to the sites


Comments
========

Comments or questions should be sent to svg-rat  at  mailman.egi.eu

If you find or become aware of another vulnerability which is relevant to EGI you may 
report it by e-mail to  

report-vulnerability at egi.eu
 
the EGI Software Vulnerability Group will take a look according to the procedure defined in [R 5]  


References
==========

[R 1] https://nvd.nist.gov/vuln/detail/CVE-2017-15566

[R 2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15566

[R 3] https://www.schedmd.com/news.php?id=193#OPT_193

[R 4] https://security-tracker.debian.org/tracker/CVE-2017-15566 

[R 5] https://documents.egi.eu/public/ShowDocument?docid=2538

Credit
======

SVG was alerted to this vulnerability by Barbara Krasovec.

Timeline  
========
Yyyy-mm-dd  [EGI-SVG-2017-CVE-2017-15566] 

2017-11-01 SVG alerted to this issue by Barbara Krasovec
2017-11-02 Acknowledgement from the EGI SVG to the reporter
2017-11-02 Investigation of vulnerability and relevance to EGI carried out by SVG
2017-11-02 EGI SVG Risk Assessment completed
2017-11-02 Advisory sent to sites


Context
=======

This advisory has been prepared as part of the effort to fulfil EGI SVG's purpose 
"To minimize the risk to the EGI infrastructure arising from software 

vulnerabilities"

The risk is that assessed by the group, according to the EGI SVG issue handling 
procedure [R 5]  in the context of how the software is used in the EGI 
infrastructure. It is the opinion of the group, we do not guarantee it to be correct. 
The risk may also be higher or lower in other deployments depending on how the software is used.   

Others may re-use this information provided they:-

1) Respect the provided TLP classification

2) Credit the EGI https://www.egi.eu/ Software Vulnerability Group



On behalf of the EGI SVG,