CVE-2024-48936

What it actually does

Incorrect authorization in stepmgr allows an attacker to execute processes under other users' jobs when --stepmgr is used or globally enabled via SlurmctldParameters=enable_stepmgr.

Why it matters to the business

Attackers could run code inside other users' compute jobs on affected HPC clusters, risking data exposure or resource misuse in research and simulation environments; low exploit likelihood reduces immediate urgency but upgrade is required for any stepmgr deployments.

How an attack unfolds

An attacker with access to a Slurm cluster that uses stepmgr identifies a job running with --stepmgr or on a system with enable_stepmgr, then abuses the authentication handling flaw to spawn processes that appear to belong to another user's job.

How to fix it

Upgrade schedmd/slurm to the version containing commit 1f8005bf270bd6ea2b4f4fa05bdbfd11673d9e89 (equivalent to 24.05.4 or later). If stepmgr is not required, remove --stepmgr flags and disable enable_stepmgr in SlurmctldParameters.

How to confirm the fix worked

Verify Slurm version is 24.05.4 or newer containing commit 1f8005bf270bd6ea2b4f4fa05bdbfd11673d9e89; audit slurm.conf for absence of enable_stepmgr and confirm no jobs use --stepmgr.

Typical attack path

1. Locate Slurm cluster with stepmgr enabled via configuration or job flags
2. Submit or observe a job using --stepmgr
3. Trigger the authorization bypass to inject or execute processes under the target job identity
4. Perform actions within the impersonated job context such as file access or computation

How to detect it

Review Slurm job step and authentication logs for unexpected process executions under job IDs not matching the submitting user; look for stepmgr-related entries around job launch times.

What your security team should do

• Immediately audit all Slurm clusters for stepmgr usage and apply the fixed commit 1f8005bf270bd6ea2b4f4fa05bdbfd11673d9e89
• Disable stepmgr globally and per-job if the feature is unused
• Monitor for new jobs using --stepmgr and review authorization logs around job step creation