Altair Grid Engine Path Hijacking Vulnerability Allowing Arbitrary Code Execution with Superuser Privileges

A vulnerability exists in Altair Grid Engine, affecting all versions prior to 2026.0.0. The issue arises because the software does not properly validate environment variables when loading shared libraries. This flaw allows path hijacking through the substitution of malicious libraries. A local attacker could exploit this vulnerability by manipulating environment variables to include a harmful library, which could then be used to execute arbitrary code with superuser privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code with superuser rights, potentially allowing an attacker to gain elevated privileges and control over the system.

Remediation

Users are advised to update Altair Grid Engine to version 2026.0.0 or later. For clusters not using the UGERest API/daemon, the setuid-root bit should be removed from the 'sgepasswd' binary for all installed architectures.