CVE-2023-1521 Local Privilege Escalation in sccache
A local attacker can escalate privileges to root by exploiting LD_PRELOAD in sccache, particularly when the server runs as root via snap.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-1521?
CVE-2023-1521 is a high-severity vulnerability in Mozilla sccache, published on 26 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.
If the server is run as root (which is the default when installing the snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.
Weakness: CWE-426
Which versions are affected by CVE-2023-1521?
2 open source packages ship an affected version, including sccache. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
sccache crates.io | All versions | 0.4.0 |
sccache crates.io | All versions | 0.4.0 |
Products include Mozilla Sccache.
How do I fix CVE-2023-1521?
Upgrade sccache to 0.4.0 or later.
Is CVE-2023-1521 being exploited?
There is no known exploitation of CVE-2023-1521 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2023-1521, GHSA-x7fr-pg8f-93f5, UBUNTU-CVE-2023-1521.