Severity by source
PR:L because valid Slurm account required; S:C because credential bypass enables library injection affecting co-located users beyond attacker's own job scope; A:L for the secondary crash path only.
Lifecycle Timeline
1DescriptionCVE.org
[Fix sbcast shared objects skipping credential verification, Fix possible slurmd crash on invalid sbcast filenames]
AnalysisAI
Credential verification bypass in Slurm's sbcast facility allows broadcast of shared objects (.so files) to job-allocated nodes without proper authentication checks, potentially enabling library injection across compute nodes. A second concurrent flaw permits invalid sbcast filenames to crash the slurmd daemon, causing a denial of service on affected compute nodes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The credential verification bypass requires an active Slurm job allocation and the ability to issue sbcast commands - meaning the attacker must have a valid Slurm user account and be able to submit and run jobs on the cluster. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Without a CVSS vector or EPSS score, risk must be inferred from description analysis alone. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch distributed through Ubuntu security channels as reported by the Ubuntu vendor advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today