CVE-2020-12693 Race condition in n/a
A race condition in Slurm allows arbitrary user process launch when Message Aggregation is enabled, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-12693?
CVE-2020-12693 is a high-severity vulnerability in Debian Debian Linux, published on 21 May 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Slurm 19.05.x before 19.05.7 and 20.02.x before 20.02.3, in the rare case where Message Aggregation is enabled, allows Authentication Bypass via an Alternate Path or Channel. A race condition allows a user to launch a process as an arbitrary user.
Which versions are affected by CVE-2020-12693?
It affects 4 products.
Linux distribution packages (8)
slurm_18_08 SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 18.08.9-1.8.2 |
slurm_18_08 SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 18.08.9-1.8.2 |
slurm_18_08 SUSE:Linux Enterprise Module for HPC 12 | All versions | 18.08.9-3.8.1 |
slurm SUSE:Linux Enterprise Module for HPC 15 SP1 | All versions | 18.08.9-3.13.2 |
slurm_20_02 SUSE:Linux Enterprise Module for HPC 15 SP1 | All versions | 20.02.3-3.8.1 |
slurm openSUSE:Leap 15.1 | All versions | 18.08.9-lp151.2.1 |
slurm openSUSE:Leap 15.1 | All versions | 18.08.9-lp151.2.10.1 |
slurm openSUSE:Leap 15.2 | All versions | 18.08.9-lp152.2.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Opensuse Leap, Schedmd Slurm.
How do I fix CVE-2020-12693?
Upgrade to a fixed version.
Is CVE-2020-12693 being exploited?
There is no known exploitation of CVE-2020-12693 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as GHSA-9rpg-w3f6-9mpm, SUSE-SU-2020:1554-1, SUSE-SU-2020:2598-1, SUSE-SU-2020:2599-1, SUSE-SU-2020:2600-1, UBUNTU-CVE-2020-12693 and 3 more.