26.05.4 with CVE patch pam patch - #85
Open
itkovian wants to merge 39 commits into
Open
Conversation
Changelog: Fix sbcast shared objects skipping credential verification. CVE-2026-65107.
Changelog: Fix possible slurmd crash on invalid sbcast filenames. CVE-2026-65107.
The replay tolerance that shared object transfers need was applied to every sbcast credential. The executable is always the first decode of a given credential and is never replayed, so pass the flag down from unpack_sbcast_cred() and leave that path strict.
spank_clear_remote_options_env() copied the variable name into a fixed 1024 byte stack buffer with an unbounded memcpy(), so an oversized SPANK option variable in the job environment smashed the stack while running as root. Use xstrndup() instead. Changelog: Fix a slurmstepd stack overflow when a job environment contains an oversized SPANK option variable. CVE-2026-65108.
_cleanup_container() removed the spool contents with path based unlink() and rmdir() as root, but the job user owns the directory components, so swapping a task directory for a symlink made root delete the target's config.json and environment. Descend from the configured spool directory with O_NOFOLLOW and remove relative to those handles. Changelog: Fix slurmstepd removing files outside the container spool directory when cleaning up an OCI container. CVE-2026-65109.
_generate_spooldir() trims the pattern at the first taskid component, so with a %t in ContainerPath the step spool dir ends in a '/' and its basename is empty, and the task dirs sit several components below it rather than directly beneath. Strip the trailing separators and walk the intervening components with O_NOFOLLOW. Changelog: Fix slurmstepd leaving OCI container spool directories behind when ContainerPath contains a task id pattern. CVE-2026-65109.
msg->len was unpacked independently of the data buffer's actual length, letting a crafted RPC over-read in _rpc_forward_data()'s safe_write(). Reject mismatched lengths. Changelog: Fix heap over-read when unpacking a malformed forward data RPC in slurmd. CVE-2026-65138.
_unpack_forward_data_msg() accepted a missing address, which unpacks to NULL and reaches strlen() in _connect_as_other(), crashing slurmd. Reject it at unpack instead. Changelog: Fix a slurmd crash when handling a malformed forward data RPC with a missing socket address. CVE-2026-65138.
Cluster names are interpolated into table identifiers, not just quoted values, and identifier quoting can't be backslash-escaped, so escaping can't neutralize them. Reject names with SQL-unsafe characters instead. Changelog: Reject cluster names containing characters that are unsafe to use in an accounting database query. CVE-2026-65139.
as_mysql_validate_cluster_list() only covered the cond fields, leaving the usage queries and the add and runaway job paths to interpolate a caller supplied name straight into a table identifier. Add a single name validator and call it there. Changelog: Reject unsafe cluster names on the accounting usage, add and runaway job paths. CVE-2026-65139.
The cluster name is taken off the persistent connection init message without any check and is used unquoted to build table names throughout the plugin, so validating the condition structures alone still leaves it reachable. Check it once when the connection is set up and refuse the connection outright. Changelog: Reject unsafe cluster names when opening a connection to the slurmdbd. CVE-2026-65139.
The numeric id lists reaching the mysql plugin are spliced into SQL, some unquoted, so a non-numeric entry could inject. Validate each list as it is unpacked rather than in every handler. The qos entries carry a leading +, - or = from the add, subtract and set syntax, so the qos check permits those operators. Changelog: Reject non-numeric id values in accounting database queries. CVE-2026-65139.
Changelog: Fix a privilege escalation where an operator could alter Administrator accounts through the accounting database. CVE-2026-65140.
pack_assoc_rec, pack_assoc_rec_with_usage and pack_event_cond put names in qos_list and reason_uid_list, which are now validated as numeric on unpack. Use numeric values so the round trip tests pass.
An arbitrary step whose node list matched the job's req_nodes, or that requested all nodes, skipped the node list check. Its node count then came from the request while its task layout came from the list, leaving step_layout->node_cnt disagreeing with the step's node bitmap. Take the count from the list in both cases. Pin max_nodes to that same count as well. Without it the later cpu_count block can raise min_nodes above the list's node count and the node top-up loops then extend the step past the nodes the list names, which is how the two counts came apart. Changelog: Fix node count of a job step using arbitrary distribution. CVE-2026-65165.
Reject one containing a hostlist function ('{').
An arbitrary step node list must be a literal list of node names.
Changelog: Reject a hostlist function in the node list of a job step
using arbitrary distribution. CVE-2026-65165.
Changelog: Reject a job step whose arbitrary node list disagrees with its node count. CVE-2026-65165.
See merge request nvidia/schedmd/slurm/slurm!4317
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.