GitHub Advisoryadvisory · crates.io

GHSA-x7fr-pg8f-93f5 sccache vulnerable to privilege escalation if server is run as root

HIGH Published 2023-05-30 Modified 2024-11-26 Official page ↗
Aliases
CVE-2023-1521
Ecosystem
crates.io
Packages
sccache
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-426
Reviewed
2023-05-30

Affected packages

• crates.io sccache: < 0.4.0 → fixed in 0.4.0

Description

Impact On Linux the `sccache` client can execute arbitrary code with the privileges of a local `sccache` server, by preloading the code in a shared library passed to `LD_PRELOAD`. If the server is run as root (which is the default when installing the snap package), this means a user running the `sccache` client can get root privileges. Patches Upgrade to 0.4.0 Workarounds Don't run sccache server as root. GitHub Security Lab number GHSL-2023-046

Related

Alias · CVE (1)

  • CVE-2023-1521 On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared… vulnerability

Weakness · CWE (1)

  • CWE-426 Untrusted Search Path weakness

References