CVE-2024-48936: 
NixOS vulnerability analysis and mitigation

CVE-2024-48936 is a security vulnerability discovered in SchedMD Slurm before version 24.05.4, disclosed in October 2024. The vulnerability stems from an incorrect authorization handling in the stepmgr subsystem that could allow an attacker to execute processes under other users' jobs (Slurm Announce).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863) with a CVSS v3.1 base score of 5.0 (Medium). The vulnerability affects systems running Slurm with either explicitly enabled --stepmgr for jobs or systems that have globally enabled stepmgr through the 'SlurmctldParameters=enable_stepmgr' configuration setting (NVD).

When exploited, this vulnerability allows an attacker to execute processes under other users' jobs, potentially compromising the security and isolation of the job execution environment (Slurm Announce).

The vulnerability has been fixed in Slurm version 24.05.4. SchedMD customers were initially informed on October 9th and provided with a patch upon request. Organizations running affected versions should upgrade to version 24.05.4 or later to address this security issue (Slurm Announce).