CVE-2022-29502

What it actually does

Incorrect access control in the Slurm controller allows unauthenticated remote attackers to bypass permission checks and execute operations with elevated privileges.

Why it matters to the business

Compromise of HPC clusters can result in unauthorized job execution, data exfiltration, resource hijacking, and disruption of scientific or enterprise workloads.

How an attack unfolds

An attacker connects to an exposed Slurm daemon and submits specially crafted job requests that exploit missing authorization checks to run commands as a privileged user.

How to fix it

Upgrade Slurm to a version newer than the 21.08.x–20.11.x range; restrict controller access to trusted networks until patches are applied.

How to confirm the fix worked

Verify installed Slurm version against vendor advisories; attempt job submission from an unprivileged network location to confirm authorization enforcement.

Typical attack path

1. Locate publicly reachable Slurm controller ports
2. Submit crafted job or command without authentication
3. Trigger privilege escalation via access-control flaw
4. Execute arbitrary code or access cluster resources

How to detect it

Review Slurm controller logs for job submissions or commands originating from unexpected IP addresses or lacking proper authentication tokens; correlate with unusual privilege changes or high-priority job executions.

What your security team should do

• Prioritize immediate upgrade of all Slurm installations
• Place Slurm controllers behind strict network ACLs
• Enable and review authentication logging on controllers
• Scan for any exposed Slurm daemons with internet-facing ports