Slurm releases versions 24.05.2, 23.11.9, and 23.02.8 with a security fix for switch plugins

Slurm versions 24.05.2, 23.11.9, and 23.02.8 are now available, including a fix for a security issue with the switch plugins. The issue affects the switch/hpe_slingshot and switch/nvidia_imex plugins where a user can override isolation between Slingshot VNIs or IMEX channels, although what information could be accessed is unclear. The disclosure is being released due to an abundance of caution and customers with these plugins enabled must restart slurmctld before slurmd to avoid disruption.```html

Slurm Versions 24.05.2, 23.11.9, And 23.02.8 Are Now Available (Security Fix For Switch Plugins)

Slurm versions 24.05.2, 23.11.9, and 23.02.8 are now available and include a fix for a recently discovered security issue with the switch plugins.

SchedMD customers were informed on July 17th and provided a patch on request; this process is documented in our security policy.

Security Issue Details

For the switch/hpe_slingshot and switch/nvidia_imex plugins, a user could override the isolation between Slingshot VNIs or IMEX channels. If you do not have one of these switch plugins configured, then you are not impacted by this issue. It is unclear what, if any, information could be accessed with access to an unauthorized channel. This disclosure is being made out of an abundance of caution.

If you do have one of these plugins enabled, the slurmctld must be restarted before the slurmd daemons to avoid disruption.