Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS14N2ZyLXBnOGYtOTNmNc4AAzhh

sccache vulnerable to privilege escalation if server is run as root

Impact

On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD.

If the server is run as root (which is the default when installing the snap package), this means a user running the sccache client can get root privileges.

Patches

Upgrade to 0.4.0

Workarounds

Don't run sccache server as root.

GitHub Security Lab number

GHSL-2023-046

Permalink: https://github.com/advisories/GHSA-x7fr-pg8f-93f5
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14N2ZyLXBnOGYtOTNmNc4AAzhh
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 11 months ago
Updated: 11 months ago


Identifiers: GHSA-x7fr-pg8f-93f5, CVE-2023-1521
References: Repository: https://github.com/mozilla/sccache
Blast Radius: 0.0

Affected Packages

cargo:sccache
Dependent packages: 0
Dependent repositories: 1
Downloads: 479,153 total
Affected Version Ranges: < 0.4.0
Fixed in: 0.4.0
All affected versions: 0.1.0, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.2.7, 0.2.8, 0.2.9, 0.2.10, 0.2.11, 0.2.12, 0.2.13, 0.2.14, 0.2.15, 0.3.0, 0.3.1, 0.3.3
All unaffected versions: 0.4.0, 0.4.1, 0.4.2, 0.5.0, 0.5.1, 0.5.3, 0.5.4, 0.6.0, 0.7.0, 0.7.1, 0.7.2, 0.7.3, 0.7.4, 0.7.5, 0.7.6, 0.7.7, 0.8.0