SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwri…

published 2023-11-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-46392

cvss: 7.0; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits: 0; none known

SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or deleting files.

Patch / fix

fixed in 1 distros 3

schedmd slurm 22.05.10, 23.02.6

debian ubuntu suse

slurm-wlm Debian 12 22.05.8-4+deb12u1
slurm-wlm Debian 14, Debian 13 23.02.6-1

debian advisories DEBIAN-CVE-2023-41914

slurm-wlm Ubuntu Pro 22.04 LTS 21.08.5-2ubuntu1+esm2

ubuntu advisories UBUNTU-CVE-2023-41914

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

slurm SLE Module for Package Hub 15 SP5, SLE High Performance Computing 15 SP4-LTSS, SLE High Performance Computing 15 SP4-ESPOS 20.11.9-150400.3.3.1
slurm_18_08 SLE Module for HPC 12 18.08.9-3.23.1
slurm_20_11 SLE Module for HPC 12 20.11.9-3.19.1
slurm_20_11 SLE High Performance Computing 15 SP2-LTSS, openSUSE Leap 15.5 20.11.9-150200.6.16.1
slurm_22_05 SLE Module for HPC 12 22.05.10-3.6.1
slurm_22_05 SLE Module for HPC 15 SP4, SLE High Performance Computing 15 SP3-LTSS, SLE High Performance Computing 15 SP3-ESPOS +2 more 22.05.10-150300.7.6.1
slurm SLE Module for Package Hub 15 SP5, SLE Module for HPC 15 SP5, openSUSE Leap 15.5 23.02.6-150500.5.12.1
slurm_23_02 SLE Module for HPC 15 SP4, SLE High Performance Computing 15 SP3-LTSS, SLE High Performance Computing 15 SP3-ESPOS +1 more 23.02.6-150300.7.14.1

suse advisories SUSE-SU-2024:0314-1 SUSE-SU-2024:0313-1 SUSE-SU-2024:0309-1 SUSE-SU-2024:0288-1 SUSE-SU-2024:0279-1 SUSE-SU-2023:4582-1

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-09-05)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	7.0	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

schedmd slurm

Classification

Weakness

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

References

lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/OWKTCYZT3DXEH66QXQJYB7NI7ONDRS4M/
vendor-advisory, mailing-list, third-party-advisory
lists.schedmd.com /pipermail/slurm-announce/2023/000100.html
mailing-list, vendor-advisory
schedmd.com /security.php
product

Sources

CVE List CVE-2023-41914
NVD CVE-2023-41914

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary