Debian Patches
Status for slurm-wlm/24.11.5-4+deb13u1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| CVE-2026-65165-1.patch | Fix step node count for arbitrary distribution An arbitrary step whose node list matched the job's req_nodes, or that requested all nodes, skipped the node list check. Its node count then came from the request while its task layout came from the list, leaving step_layout->node_cnt disagreeing with the step's node bitmap. Take the count from the list in both cases. Pin max_nodes to that same count as well. Without it the later cpu_count block can raise min_nodes above the list's node count and the node top-up loops then extend the step past the nodes the list names, which is how the two counts came apart. |
Dominik Bartkiewicz <dbartkiewicz@nvidia.com> | no | 2026-09-02 | ||
| CVE-2026-65165-2.patch | Reject hostlist functions in arbitrary step node list Reject one containing a hostlist function ('{'). An arbitrary step node list must be a literal list of node names. (cherry picked from commit ae9894fec202426a7ae2a2a73808b6c2db5713f7) |
Dominik Bartkiewicz <dbartkiewicz@nvidia.com> | no | 2026-09-02 | ||
| CVE-2026-65165-3.patch | Reject arbitrary step layout with inconsistent node count (cherry picked from commit 6b9442f4ea2fe6b949983a2c4f32449a3955a774) |
Dominik Bartkiewicz <dbartkiewicz@nvidia.com> | no | 2026-09-01 | ||
| CVE-2026-65168-1.patch | slurmstepd - Guard against invalid lengths in getpw/getgr/gethost (cherry picked from commit 3c4deabda9dac3f93a1a947479a55887fc65ea88) |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-11 | ||
| CVE-2026-65168-2.patch | slurmstepd - Guard against invalid lengths in the job owner handlers (cherry picked from commit a6cba9c22ca3721ac42e7086b6c8fd8e508ef979) |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-11 | ||
| CVE-2026-65168-3.patch | slurmstepd - Guard against invalid lengths in completion and reconfig (cherry picked from commit b882d822c117ec538f813f83a2b4ba2dad3987c4) |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-18 | ||
| CVE-2026-65168-4.patch | slurmstepd - Guard against invalid lengths in the attach handler (cherry picked from commit b27f8949b7c5d6caf9e59ae79b176a049d2f22af) |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-18 | ||
| mail-path | mail command absolute pathname This patch changes the default command to /usr/bin/mail in various configuration files and manual pages. |
Gennaro Oliva <oliva.g@na.icar.cnr.it> | not-needed | debian | 2024-07-21 | |
| remove-google-javascript | Remove google custom engine queries script Remove javascript for the custom google engine queries, in the header and in the footer of each html documentation page, to avoid potential privacy breach. |
Gennaro Oliva <oliva.g@na.icar.cnr.it> | not-needed | other | 2016-09-29 | |
| sacctmgr-increase-buffer | Increase size of sacctmgr read buffer This patch significantly increases the size of the buffer for reading dumps with sacctmgr load. Without this patch, sacctmgr is not able to handle lines with more than 4096 which is too small in some cases. Also removed useless macro definition in other related file. |
Rémi Palancher <remi@rezib.org> | yes | 2019-09-06 | ||
| pidfile-path | Fix default pidfile paths This patch points default pidfild paths under /run | Mehdi Dogguy <mehdi@debian.org> and Gennaro Oliva <oliva.g@na.icar.cnr.it> | not-needed | debian | 2024-07-21 | |
| rpath | Fix an rpath issue The libdir has to match the source package name in order to host slurm's private shared library. |
Mehdi Dogguy <mehdi@debian.org> | not-needed | 2018-01-12 | ||
| miscellanea-manpages | Move general info man pages to the miscellanea section (7) This patch moves the general information man pages slurm.1 and spank.8 to the miscellanea section since they are not related to commands |
Gennaro Oliva <oliva.g@na.icar.cnr.it> | yes | 2024-07-21 | ||
| retry-getaddrinfo | Retry getaddrinfo five times before giving up This patch retry getaddrinfo five times before giving up and exiting SLURM deamons. This is needed on Debian systems when using ifupdown for network configuration with allow-hotplug interfaces (which the installer uses by default). This settings do not guarantee that getaddrinfo succeed after network-online.target is complete. |
Gennaro Oliva <oliva.g@na.icar.cnr.it> | yes | 2024-12-01 | ||
| force-nvml | Force nvml configuration without autodetection This patch will force nvml configuration without autodetection at build time. This is necessary to enable the nvml contrib plugin |
Gennaro Oliva <oliva.g@na.icar.cnr.it> | yes | vendor | 2024-07-21 | |
| fix-typos | Fix typos in code and man pages This patch fix some typos in code and man pages | Gennaro Oliva <oliva@debian.org> | yes | 2024-07-21 | ||
| fix-manpages | Fix typos in man pages This patch fix some typos in two man pages | Gennaro Oliva <oliva@debian.org> | yes | 2024-12-07 | ||
| CVE-2026-65107-1.patch | Verify sbcast credential signatures for FILE_BCAST_SO transfers | Tim McMullan <tmcmullan@nvidia.com> | no | 2026-05-15 | ||
| CVE-2026-65107-2.patch | slurmd - Reject invalid sbcast filenames | Tim McMullan <tmcmullan@nvidia.com> | no | 2026-05-15 | ||
| CVE-2026-65107-3.patch | cred - Only allow sbcast credential replay for shared objects The replay tolerance that shared object transfers need was applied to every sbcast credential. The executable is always the first decode of a given credential and is never replayed, so pass the flag down from unpack_sbcast_cred() and leave that path strict. |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-17 | ||
| CVE-2026-65108.patch | Fix stack overflow clearing spank option environment spank_clear_remote_options_env() copied the variable name into a fixed 1024 byte stack buffer with an unbounded memcpy(), so an oversized SPANK option variable in the job environment smashed the stack while running as root. Use xstrndup() instead. |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-04 | ||
| CVE-2026-65109-1.patch | runtime/oci - Do not resolve container spool paths as root on cleanup _cleanup_container() removed the spool contents with path based unlink() and rmdir() as root, but the job user owns the directory components, so swapping a task directory for a symlink made root delete the target's config.json and environment. Descend from the configured spool directory with O_NOFOLLOW and remove relative to those handles. |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-10 | ||
| CVE-2026-65109-2.patch | runtime/oci - Handle a taskid pattern in ContainerPath on cleanup _generate_spooldir() trims the pattern at the first taskid component, so with a %t in ContainerPath the step spool dir ends in a '/' and its basename is empty, and the task dirs sit several components below it rather than directly beneath. Strip the trailing separators and walk the intervening components with O_NOFOLLOW. |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-11 | ||
| CVE-2026-65138-1.patch | Fix heap over-read in REQUEST_FORWARD_DATA unpack msg->len was unpacked independently of the data buffer's actual length, letting a crafted RPC over-read in _rpc_forward_data()'s safe_write(). Reject mismatched lengths. |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-07-09 | ||
| CVE-2026-65138-2.patch | Fix NULL dereference in REQUEST_FORWARD_DATA unpack _unpack_forward_data_msg() accepted a missing address, which unpacks to NULL and reaches strlen() in _connect_as_other(), crashing slurmd. Reject it at unpack instead. |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-04 | ||
| CVE-2026-65139-1.patch | accounting_storage/mysql - Reject unsafe cluster names Cluster names are interpolated into table identifiers, not just quoted values, and identifier quoting can't be backslash-escaped, so escaping can't neutralize them. Reject names with SQL-unsafe characters instead. |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-07-09 | ||
| CVE-2026-65139-2.patch | accounting_storage/mysql - Validate cluster names on the remaining paths as_mysql_validate_cluster_list() only covered the cond fields, leaving the usage queries and the add and runaway job paths to interpolate a caller supplied name straight into a table identifier. Add a single name validator and call it there. |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-04 | ||
| CVE-2026-65139-3.patch | accounting_storage/mysql - Validate the cluster name on the connection The cluster name is taken off the persistent connection init message without any check and is used unquoted to build table names throughout the plugin, so validating the condition structures alone still leaves it reachable. Check it once when the connection is set up and refuse the connection outright. |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-12 | ||
| CVE-2026-65139-4.patch | Validate accounting id lists as numeric when unpacking The numeric id lists reaching the mysql plugin are spliced into SQL, some unquoted, so a non-numeric entry could inject. Validate each list as it is unpacked rather than in every handler. The qos entries carry a leading +, - or = from the add, subtract and set syntax, so the qos check permits those operators. |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-19 | ||
| CVE-2026-65139-5.patch | Testsuite - Use numeric ids in the slurmdb pack tests pack_assoc_rec, pack_assoc_rec_with_usage and pack_event_cond put names in qos_list and reason_uid_list, which are now validated as numeric on unpack. Use numeric values so the round trip tests pass. (cherry picked from commit 9db8b711a8ab8c0ed1ecc7bdb4ecb53a990d8ffe) |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-19 | ||
| CVE-2026-65140-1.patch | accounting_storage/mysql - Don't rewrite admin_level on existing user | Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-11 | ||
| CVE-2026-65140-2.patch | accounting_storage/mysql - Don't rewrite admin_level (cond) (cherry picked from commit 77d9338ae17e89ff129992fd8146bd821b1deedb) |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-11 | ||
| CVE-2026-65140-3.patch | accounting_storage/mysql - Require SUPER_USER to grant SUPER_USER (cherry picked from commit 6312dd2d02be625b0c491bf236d2d67109967d9a) |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-11 | ||
| CVE-2026-65140-4.patch | accounting_storage/mysql - Require SUPER_USER in as_mysql_add_users_cond (cherry picked from commit a82ec42d52b5ff092a7cc620332449ea6670c80b) |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-11 | ||
| CVE-2026-65140-5.patch | accounting_storage/mysql - Require SUPER_USER to remove an Administrator (cherry picked from commit 56ad4b7574a008958af5c3830ecdc5c224383254) |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-11 | ||
| CVE-2026-65140-6.patch | accounting_storage/mysql - Require SUPER_USER to rename an Administrator (cherry picked from commit f1101a696f7f7de4602ddd12941f2cd6f1ad5799) |
Tim McMullan <tmcmullan@nvidia.com> | no | 2026-08-11 |
All known versions for source package 'slurm-wlm'
- 26.05.4-1 (sid)
- 26.05.3-1 (forky)
- 24.11.5-4+deb13u1 (trixie-security)
- 24.11.5-4 (trixie)
- 22.05.8-4+deb12u3 (bookworm-security, bookworm)