CVE-2023-1521: sccache vulnerable to privilege escalation if server is run as root

May 30, 2023 (updated November 26, 2024)

On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.

If the server is run as root (which is the default when installing the snap package), this means a user running the sccache client can get root privileges.

References

github.com/advisories/GHSA-x7fr-pg8f-93f5
github.com/mozilla/sccache
github.com/mozilla/sccache/releases/tag/v0.4.0
github.com/mozilla/sccache/security/advisories/GHSA-x7fr-pg8f-93f5
nvd.nist.gov/vuln/detail/CVE-2023-1521
securitylab.github.com/advisories/GHSL-2023-046_ScCache

Detect and mitigate CVE-2023-1521 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →