Severity by source
Job submission is network-reachable (AV:N), requires authenticated SLURM user (PR:L), no interaction needed, and slurmstepd privilege escalation changes scope (S:C) with full node compromise.
Lifecycle Timeline
1DescriptionCVE.org
[Fix a slurmstepd stack overflow when a job environment contains an oversized SPANK option variable]
AnalysisAI
Stack-based buffer overflow in slurmstepd, the SLURM job step daemon, can be triggered by an authenticated cluster user who submits a job containing an oversized SPANK (SLURM Plug-in Architecture for Node and job Control) option variable in the job environment. Because slurmstepd typically executes with elevated privileges on compute nodes, successful exploitation could allow a regular SLURM user to achieve privilege escalation or arbitrary code execution on cluster nodes. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an account with SLURM job submission rights on an affected cluster - that is, a user who can run sbatch, srun, or equivalent SLURM submission commands. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The real-world risk is significant in HPC environments despite the absence of a CVSS score, KEV listing, and public exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Ubuntu-issued security update for the SLURM packages (slurm-wlm, slurmctld, slurmd, slurmstepd) as soon as it is published via Ubuntu's security notices (USN). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today