Vulnerability · Published Nov 26, 2024 · Assigned by mozilla

CVE-2023-1521Local Privilege Escalation in sccache

High 7.8

In plain English

A high-severity security flaw in sccache from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.4%top 69.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD. If the server is run as root (which is the default when installing the snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	sccache	no fix listed	DEBIAN-CVE-2023-1521
Debian:13	sccache	0.5.3-1	DEBIAN-CVE-2023-1521
Debian:14	sccache	0.5.3-1	DEBIAN-CVE-2023-1521
Ubuntu:25.10	sccache	no fix listed	UBUNTU-CVE-2023-1521
Ubuntu:26.04:LTS	sccache	no fix listed	UBUNTU-CVE-2023-1521
Ubuntu:26.10	sccache	no fix listed	UBUNTU-CVE-2023-1521

Affected products (as reported)

Vendor	Product	Versions
Mozilla	sccache	0 – before 0.4.0

Weakness: CWE-426 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://securitylab.github.com/advisories/GHSL-2023-046_ScCache third-party-advisory
https://github.com/advisories/GHSA-x7fr-pg8f-93f5 vendor-advisory