-
Notifications
You must be signed in to change notification settings - Fork 313
(3.9.0‐3.13.0) Privilege escalation on Slurm accounting caused by CVE‐2025‐43904
Giacomo Marciani edited this page May 9, 2025
·
1 revision
Slurm versions 23.11 and 24.05 are affected by CVE-2025-43904. When Slurm accounting is enabled on the cluster, this vulnerability allows a Coordinator user to promote another user to Administrator.
All ParallelCluster versions from 3.9.0 to 3.13.0 on all OSes, when Slurm accounting is enabled and Coordinator users are configured.
To mitigate this issue, we recommend upgrading the Slurm version on your running cluster to the maintenance version that ships the fix. To this aim you must upgrade Slurm within the same minor version. In particular:
- For ParallelCluster >=3.9.0,<=3.12.0, which ship Slurm 23.11: upgrade to Slurm 23.11.11.
- For ParallelCluster 3.13.0, which ship Slurm 24.05: upgrade to Slurm 24.05.8.
To upgrade Slurm on a running cluster, then follow the steps in Upgrade Slurm in an AWS ParallelCluster cluster.