HighCVSS 7.0
EPSS 0.15%
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.
Product
NVIDIA Slurm vulnerabilities
8 published CVES affecting NVIDIA Slurm, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 8
- Critical
- 0
- High
- 1
- Medium
- 7
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Latest NVIDIA Slurm CVEs
Newest publication first
-
-
MediumCVSS 5.3 EPSS 0.13%
NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.
-
MediumCVSS 5.7 EPSS 0.13%
NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator.
-
MediumCVSS 6.3 EPSS 0.17%
NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.
-
MediumCVSS 6.3 EPSS 0.15%
NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.
-
MediumCVSS 4.7 EPSS 0.14%
NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node.
-
MediumCVSS 6.3 EPSS 0.14%
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.
-
MediumCVSS 6.3 EPSS 0.12%
NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.