CVE-2017-15566 Privilege escalation in n/a
Attackers can escalate privileges to root via insecure environment variable handling in Slurm during Prolog or Epilog execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-15566?
CVE-2017-15566 is a high-severity vulnerability in n/a, published on 1 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Insecure SPANK environment variable handling exists in SchedMD Slurm before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, allowing privilege escalation to root during Prolog or Epilog execution.
Weakness: CWE-426
Which versions are affected by CVE-2017-15566?
It affects 1 product.
Linux distribution packages (3)
pdsh SUSE:Linux Enterprise Module for HPC 12 | All versions | 2.33-7.5.17 |
slurm SUSE:Linux Enterprise Module for HPC 12 | All versions | 17.02.9-6.10.1 |
slurmlibs SUSE:Linux Enterprise Module for HPC 12 | All versions | 16.05.8.1-6.1 |
Products include Schedmd Slurm.
How do I fix CVE-2017-15566?
Upgrade to a fixed version.
Is CVE-2017-15566 being exploited?
There is no known exploitation of CVE-2017-15566 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DSA-4023-1, GHSA-h3p2-v728-89g5, SUSE-SU-2017:3311-1, UBUNTU-CVE-2017-15566.