File Ownership Escalation Vulnerability in Gentoo Slurm
CVE-2020-36770

9.8CRITICAL

Key Information:

Vendor

Gentoo

Status
Ebuild For Slurm
Vendor
CVE Published:
15 January 2024

What is CVE-2020-36770?

A vulnerability exists in the Gentoo ebuild for Slurm versions up to 22.05.3 that involves the pkg_postinst script calling chown to give root ownership of files in the live root filesystem. This improper handling can be exploited by the slurm user, allowing them to gain ownership of root-owned files, which poses a significant risk to system integrity and security configurations.

References

https://bugs.gentoo.org/631552

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.