From 105e93dfc72bbe2dd77cc465dac7b5429c59f4c9 Mon Sep 17 00:00:00 2001 From: christopher5106 Date: Wed, 12 Aug 2026 16:45:57 +0200 Subject: [PATCH] fix: avoid shell interpolation of SLURM_NODELIST (CVE-2024-27763) _init_dist_slurm passed the SLURM_NODELIST environment variable into a shell command string via subprocess.getoutput, so a crafted value could execute arbitrary commands: SLURM_NODELIST='x; touch /tmp/PWNED; echo done' Pass the node list as an argv element instead, and take the first line in Python rather than piping through `head -n1`. Output is unchanged for well-formed node lists. Combined stdout/stderr and the non-raising behaviour of getoutput are preserved, with one difference worth noting: a missing `scontrol` binary now raises FileNotFoundError instead of silently assigning a shell error message to MASTER_ADDR. --- basicsr/utils/dist_util.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/basicsr/utils/dist_util.py b/basicsr/utils/dist_util.py index 0fab887b2..b3d6a65c4 100644 --- a/basicsr/utils/dist_util.py +++ b/basicsr/utils/dist_util.py @@ -41,7 +41,14 @@ def _init_dist_slurm(backend, port=None): node_list = os.environ['SLURM_NODELIST'] num_gpus = torch.cuda.device_count() torch.cuda.set_device(proc_id % num_gpus) - addr = subprocess.getoutput(f'scontrol show hostname {node_list} | head -n1') + # `SLURM_NODELIST` is environment-controlled input, so it is passed as an argv + # element instead of being interpolated into a shell command (CVE-2024-27763). + # `head -n1` is replaced by taking the first line in Python. + hostnames = subprocess.run(['scontrol', 'show', 'hostname', node_list], + stdout=subprocess.PIPE, + stderr=subprocess.STDOUT, + text=True).stdout + addr = hostnames.split('\n')[0] # specify master port if port is not None: os.environ['MASTER_PORT'] = str(port)