« Volver al listado

CVE-2016-10030

Estado: ModificadaAlta (8.1)—

The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd daemon informs users of a Prolog failure on a compute node. That vulnerability could allow a user to assume control of an arbitrary file on the system. Any exploitation of this is dependent on the user being able to cause or anticipate the failure (non-zero return code) of a Prolog script that their job would run on. This issue affects all Slurm versions from 0.6.0 (September 2005) to present.

Leer descripción completaMostrar menos

Workarounds to prevent exploitation of this are to either disable your Prolog script, or modify it such that it always returns 0 ("success") and adjust it to set the node as down using scontrol instead of relying on the slurmd to handle that automatically. If you do not have a Prolog set you are unaffected by this issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Schedmd — Slurm

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2016-10030",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "HIGH",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-01-05T11:59:00.133",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/95299",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/SchedMD/slurm/commit/92362a92fffe60187df61f99ab11c249d44120ee",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.schedmd.com/news.php?id=178",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/95299",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/SchedMD/slurm/commit/92362a92fffe60187df61f99ab11c249d44120ee",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.schedmd.com/news.php?id=178",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd daemon informs users of a Prolog failure on a compute node. That vulnerability could allow a user to assume control of an arbitrary file on the system. Any exploitation of this is dependent on the user being able to cause or anticipate the failure (non-zero return code) of a Prolog script that their job would run on. This issue affects all Slurm versions from 0.6.0 (September 2005) to present. Workarounds to prevent exploitation of this are to either disable your Prolog script, or modify it such that it always returns 0 (\"success\") and adjust it to set the node as down using scontrol instead of relying on the slurmd to handle that automatically. If you do not have a Prolog set you are unaffected by this issue."
    },
    {
      "lang": "es",
      "value": "La función _prolog_error en slurmd/req.c en Slurm en versiones anteriores a 15.08.13, 16.x en versiones anteriores a 16.05.7 y 17.x en versiones anteriores a 17.02.0-pre4 tiene una vulnerabilidad en como el slurmd daemon informa a los usuarios de un fallo Prolog en un nodo de cálculo. Esta vulnerabilidad podría permitir a un usuario asumir el control de un archivo arbitrario en el sistema. Cualquier explotación de esto depende de que el usuario pueda provocar o anticipar el fallo (código de retorno distinto de cero) de una secuencia de comandos Prolog que ejecutaría su trabajo. Este problema afecta a todas las versiones de Slurm desde la 0.6.0 (septiembre de 2005) hasta el presente. Las soluciones para evitar la explotación de esto son para deshabilitar su secuencia de comandos Prolog, o modificarlo de tal manera que siempre devuelva 0 (\"éxito\") y ajustarlo para establecer el nodo como caído utilizando scontrol en lugar de confiar en slurmd para manejarlo automáticamente. Si no tiene un conjunto Prolog, no se verá afectado por este problema."
    }
  ],
  "lastModified": "2026-06-17T00:38:55.210",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0909E51-4336-4389-93EA-0B2F5497F572",
              "versionEndIncluding": "15.08.12"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4CF0BB7E-6A58-44F1-B256-050B994337C7"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.0:pre1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC0DE382-132A-4368-A5EE-E4C41356DFDC"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.0:pre2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE5FDB9D-001B-40E0-A03C-FC6DC613A9AC"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91FFABC7-8770-4D73-901F-5DB67FE038FB"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7744D1CC-1C6A-48E3-9CEB-EC2F4ACCF5A8"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4D0908F7-FB4C-430A-A710-8436F02FCFEA"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "66F7F64E-CB09-440E-A54B-DDC7BBB0B3BF"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "985B2E2F-6215-4B7A-B6DD-3D1814E1F015"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6E18A9C0-A73F-4BAA-A7FF-9B2B30C61224"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BE93BD8-C330-4504-B44A-C727D71D7EC4"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:16.05.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A05FDEE-FE60-45C0-8AA8-277DADF87926"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:17.02.0:pre1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2D03B41-F9D6-41EB-AEE7-B2673BECA338"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:17.02.0:pre2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2DD1E41-DE4C-4C0A-ABBD-3360AF9DECFB"
            },
            {
              "criteria": "cpe:2.3:a:schedmd:slurm:17.02.0:pre3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE470D55-EB72-4C0E-BA6F-A7D9A5B34C13"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}