Skip to content
Fencer Intel
high 7.8

CVE-2023-1521 json

Local Privilege Escalation in sccache

published 3y ago modified 4mo ago also GHSA-x7fr-pg8f-93f5 , EUVD-2023-1648

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits
0
none known

Summary

On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.

If the server is run as root (which is the default when installing the snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.

Patch / fix

  • crates.io sccache 0.4.0
  • Mozilla sccache 0.4.0
  • sccache Debian 14, Debian 13 0.5.3-1

debian advisories DEBIAN-CVE-2023-1521

  • sccache SLE Module for Development Tools 15 SP5, SLE Module for Development Tools 15 SP4, openSUSE Leap 15.5 +1 more 0.4.2~3-150400.3.3.1
  • sccache SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +4 more 0.4.1~18-150300.7.12.1

suse advisories SUSE-SU-2023:3526-1SUSE-SU-2023:2637-1

Is CVE-2023-1521 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
last yr.

Exploit prediction

0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-14).

Exploits and checks

  • securitylab.github.com https://securitylab.github.com/advisories/GHSL-2023-046_ScCache referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
crates.io sccache
<0.4.0
0.4.0

Affected products

  • Mozilla sccache

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.