Vulnerability in torque - security update
Summary
DSA-3058-1: torque - security update. Affects torque versions < 2.4.16+dfsg-1+deb7u4. Fixed in 2.4.16+dfsg-1+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Torque is a PBS-derived batch processing queueing system. It is used to manage and schedule jobs on a cluster of computers. The package provides a set of commands and libraries for job submission, monitoring, and control. Torque allows users to submit jobs to be executed on the cluster, and it manages the allocation of resources and scheduling of these jobs. The vulnerability in torque allows a non-root user to exploit the tm_adopt() library call and kill any process, including root-owned ones on any node in a job.
Vulnerability Detail
The vulnerability in torque arises from a flaw in the tm_adopt() library call. By exploiting this flaw, a non-root user can kill any process, even those owned by the root user, on any node in a job. This can lead to unauthorized termination of critical processes and potential disruption of the system. The vulnerability affects torque versions prior to 2.4.16+dfsg-1+deb7u4.
How To Fix
Minimum fixed version
2.4.16+dfsg-1+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade torqueTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to mitigate the risk.
Conclusion
The vulnerability in torque allows a non-root user to kill any process, including root-owned ones, on any node in a job. To mitigate this risk, it is crucial to upgrade the torque package to version 2.4.16+dfsg-1+deb7u4 or later. No known workaround exists for this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for torque →
FAQ
Torque is a PBS-derived batch processing queueing system used for managing and scheduling jobs on a cluster of computers.
The vulnerability allows a non-root user to kill any process, including root-owned ones, on any node in a job, potentially leading to unauthorized termination of critical processes.
The vulnerability affects torque versions prior to 2.4.16+dfsg-1+deb7u4.
No, there is no known workaround. It is recommended to apply the security update to mitigate the risk.
To update the torque package, use the package manager of the Debian 7 (wheezy) distribution and upgrade to version 2.4.16+dfsg-1+deb7u4 or later.
Related vulnerabilities
Recent vulnerabilities recorded for torque.
