{"id":"CVE-2023-1521","aliases":["DEBIAN-CVE-2023-1521","EUVD-2023-1648","GHSA-x7fr-pg8f-93f5","SUSE-SU-2023:2637-1","SUSE-SU-2023:3526-1","UBUNTU-CVE-2023-1521"],"status":"published","title":"Local Privilege Escalation in sccache","description":"On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.\n\n\nIf the server is run as root (which is the default when installing the  snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00363,"percentile":0.30517,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-426"],"published":"2023-05-30T20:06:02Z","modified":"2026-10-26T18:01:17Z","exploits":[{"source":"pocgithub","id":"rubbxalc/CVE-2023-1521","title":"rubbxalc/CVE-2023-1521","date":"2023-11-15","url":"https://github.com/rubbxalc/CVE-2023-1521"}],"fixes":[{"ecosystem":"crates.io","package":"sccache","fixed_in":["0.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"sccache","fixed_in":["0.5.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sccache","fixed_in":["0.5.3-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-1","0.10.0-10","0.10.0-2","0.10.0-3","0.10.0-4","0.10.0-5","0.10.0-6","0.10.0-7","0.10.0-8","0.10.0-9","0.11.0-1","0.12.0-1","0.12.0-2","0.12.0-3","0.13.0+ds-1","0.13.0+ds-2","0.13.0+ds-3","0.14.0+ds-1","0.14.0+ds-2","0.14.0+ds-3","0.14.0+ds-4","0.15.0+ds-1","0.16.0+ds-1","0.17.0+ds-1","0.17.0+ds-2","0.17.0+ds-3","0.4.0~~pre6-1","0.4.0~~pre7-1","0.4.0~~pre8-1","0.4.0~~pre8-2","0.4.0~~pre8-3","0.4.0~~pre8-4","0.4.0~~pre8-5","0.4.0~~pre8-6","0.4.0~~pre8-7","0.4.0~~pre8-8","0.4.2-1","0.5.0-1","0.5.3-1","0.5.4-1","0.5.4-10","0.5.4-11","0.5.4-12","0.5.4-2","0.5.4-3","0.5.4-4","0.5.4-5","0.5.4-6","0.5.4-7","0.5.4-8","0.5.4-9","0.7.4-1","0.7.4-2","0.7.4-3","0.7.5-1","0.7.5-2","0.7.6-1","0.7.7-1","0.7.7-2","0.8.0-1","0.8.0-2","0.8.0-3","0.8.1-1","0.8.1-2","0.8.1-3","0.8.1-4","0.8.1-5","0.8.1-6","0.8.1-7","0.8.1-8","0.8.2-1","0.8.2-2","0.9.0-1","0.9.0-2","0.9.0-3","0.9.1-1","0.9.1-2","0.9.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.3-1"}]}]},{"source":"osv","ecosystem":"crates.io","package":"sccache","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1~18-150300.7.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1~18-150300.7.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1~18-150300.7.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1~18-150300.7.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1~18-150300.7.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1~18-150300.7.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1~18-150300.7.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2~3-150400.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2~3-150400.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2~3-150400.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2~3-150400.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.4-2","0.7.4-3","0.7.5-1","0.7.5-2","0.7.6-1","0.7.7-1","0.7.7-2","0.7.7-2build1","0.7.7-2ubuntu0.1~esm1","0.7.7-2ubuntu0.1","0.7.7-2ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-3","0.10.0-4","0.10.0-7","0.10.0-7ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.13.0+ds-3","0.17.0+ds-3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.10.0-7","0.11.0-1","0.12.0-2","0.12.0-3","0.13.0+ds-1","0.13.0+ds-3","0.13.0+ds-3build1"]}],"products":[{"vendor":"mozilla","product":"sccache"}],"references":[{"url":"https://securitylab.github.com/advisories/GHSL-2023-046_ScCache","tags":["third-party-advisory","Exploit","evidence","advisory","report"]},{"url":"https://github.com/advisories/GHSA-x7fr-pg8f-93f5","tags":["vendor-advisory","Third Party Advisory","advisory","report"]},{"url":"https://github.com/mozilla/sccache/security/advisories/GHSA-x7fr-pg8f-93f5","tags":["web"]},{"url":"https://github.com/mozilla/sccache/releases/tag/v0.4.0","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1521","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-1521","tags":["advisory"]},{"url":"https://github.com/mozilla/sccache","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232637-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208553","tags":["report"]},{"url":"https://bugzilla.suse.com/1212407","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1521","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233526-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1194119","tags":["report"]},{"url":"https://bugzilla.suse.com/1196972","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24713","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-1521","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-1521","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-1521","title":"Local Privilege Escalation in sccache","description":"On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.\n\n\nIf the server is run as root (which is the default when installing the  snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.","status":"published","published":"2024-11-26T11:15:59.434Z","modified":"2024-11-26T20:45:48.176Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:35:31.657022Z"}],"euvd":[{"id":"EUVD-2023-1648","description":"On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.\n\n\nIf the server is run as root (which is the default when installing the  snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.","status":"published","published":"2024-11-26T11:15:59Z","modified":"2024-11-26T20:45:48Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:46.096988Z"}],"ghsa":[{"id":"GHSA-x7fr-pg8f-93f5","title":"sccache vulnerable to privilege escalation if server is run as root","description":"### Impact\n\nOn Linux the `sccache` client can execute arbitrary code with the privileges of a local `sccache` server, by preloading the code in a shared library passed to `LD_PRELOAD`.\n\nIf the server is run as root (which is the default when installing the [snap package](https://snapcraft.io/sccache)), this means a user running the `sccache` client can get root privileges.\n\n\n### Patches\nUpgrade to 0.4.0\n\n### Workarounds\nDon't run sccache server as root. \n\n###  GitHub Security Lab number\n\nGHSL-2023-046","status":"published","published":"2023-05-30T20:06:02Z","modified":"2025-01-26T16:43:04Z","cvss":[{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"},{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:38:28.945236Z"}],"nvd":[{"id":"CVE-2023-1521","description":"On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.\n\n\nIf the server is run as root (which is the default when installing the  snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.","status":"published","published":"2024-11-26T12:15:18.203Z","modified":"2026-06-17T05:28:08.833Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T14:09:19.052418Z"}],"osv":[{"id":"CVE-2023-1521","description":"On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.\n\n\nIf the server is run as root (which is the default when installing the  snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.","status":"published","published":"2024-11-26T12:15:18.203Z","modified":"2026-04-10T04:54:22.579367Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:29.487253Z"},{"id":"DEBIAN-CVE-2023-1521","description":"On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.   If the server is run as root (which is the default when installing the  snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.","status":"published","published":"2024-11-26T12:15:18.203Z","modified":"2026-10-26T18:01:17.426089701Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"GHSA-x7fr-pg8f-93f5","title":"sccache vulnerable to privilege escalation if server is run as root","description":"### Impact\n\nOn Linux the `sccache` client can execute arbitrary code with the privileges of a local `sccache` server, by preloading the code in a shared library passed to `LD_PRELOAD`.\n\nIf the server is run as root (which is the default when installing the [snap package](https://snapcraft.io/sccache)), this means a user running the `sccache` client can get root privileges.\n\n\n### Patches\nUpgrade to 0.4.0\n\n### Workarounds\nDon't run sccache server as root. \n\n###  GitHub Security Lab number\n\nGHSL-2023-046","status":"published","published":"2023-05-30T20:06:02Z","modified":"2024-11-26T18:57:08Z","cvss":[{"version":"3.1","score":8.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":7.3,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","level":"high"}],"cwes":["CWE-426"],"updated_at":"2026-11-02T15:46:59.484835Z"},{"id":"UBUNTU-CVE-2023-1521","description":"On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD. If the server is run as root (which is the default when installing the snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.","status":"published","published":"2024-11-26T12:15:00Z","modified":"2026-10-17T12:56:00.808014752Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:18.756095Z"},{"id":"SUSE-SU-2023:2637-1","title":"Security update for sccache","description":"This update for sccache fixes the following issues:\n\n- CVE-2023-1521: Fixed possible code injection via LD_PRELOAD to sccache server (bsc#1212407).\n- CVE-2022-31394: Fixed a denial-of-service vulnerability via header list size (bsc#1208553). \n","status":"published","published":"2023-06-26T13:06:42Z","modified":"2026-02-04T02:32:53.823148Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:3526-1","title":"Security update for sccache","description":"This update for sccache fixes the following issues:\n\n- Update to version 0.4.2.\n- CVE-2021-45710: Fixed a segmentation fault due to data race in tokio crate. (bsc#1194119)\n- CVE-2022-24713: Fixed a ReDoS issue due to vulnerable regex crate. (bsc#1196972)\n- CVE-2022-31394: Fixed a DoS issue due to the max header list size not settable. (bsc#1208553)\n- CVE-2023-1521: Fixed a local privilege escalation. (bsc#1212407)\n","status":"published","published":"2023-09-05T07:56:33Z","modified":"2026-02-04T04:06:52.862143Z","updated_at":"2026-11-02T15:53:53.440387Z"}]}}