CVE-2025-43904: 
Linux Debian vulnerability analysis and mitigation

A security vulnerability (CVE-2025-43904) was discovered in Slurm's accounting system that affects permission handling for Coordinators. The vulnerability was initially reported by Sekou Diakite from HPE and was disclosed on April 23rd, 2025. The issue affects multiple versions of Slurm, including versions prior to 24.11.5, 24.05.8, and 23.11.11 (Slurm Announce).

The vulnerability stems from a mistake in permission handling within Slurm's accounting system that could allow a Coordinator to promote a user to Administrator privileges. This represents a privilege escalation vulnerability that could compromise the security model of the Slurm workload manager (Slurm Announce).

The vulnerability allows Coordinators to elevate user privileges to Administrator level, potentially compromising the entire system's security model. This could lead to unauthorized administrative access and potential system compromise (Slurm Announce).

The vulnerability has been patched in Slurm versions 24.11.5, 24.05.8, and 23.11.11. Users are strongly advised to upgrade to these versions or later to address the security issue. The fix prevents Coordinators from adding users with elevated privileges (Slurm Announce).