CVE-2023-1521

What it actually does

Local privilege escalation on Linux where an unprivileged sccache client forces the sccache server process to load and execute attacker-controlled code supplied via the LD_PRELOAD environment variable, inheriting the server's privileges.

Why it matters to the business

Unprivileged users on affected Linux systems can obtain root-level access, enabling full host compromise, data theft, persistence, or lateral movement; the issue remains relevant wherever the snap-packaged server runs as root.

How an attack unfolds

An attacker on the same host prepares a malicious shared library, sets LD_PRELOAD to point to it, and invokes the sccache client; the server accepts the connection and loads the library with its own privileges, executing the attacker's code.

How to fix it

Upgrade sccache to a version that sanitizes or ignores LD_PRELOAD for client-server communication; avoid running the server as root; uninstall the snap package if it is the installation method; restrict sccache usage to trusted users only.

How to confirm the fix worked

Verify the installed sccache version against the latest release notes; confirm that LD_PRELOAD is stripped or rejected by the server; test by attempting a benign LD_PRELOAD injection and observing whether it is honored.

Typical attack path

1. Locate a running sccache server (commonly via snap, root-owned)
2. Compile or obtain a malicious shared library exporting a constructor function
3. Export LD_PRELOAD pointing to the library and invoke the sccache client binary
4. Server loads the library and executes attacker code with root privileges
5. Attacker performs post-exploitation actions under elevated context

How to detect it

Search process execution logs and environment variable captures for sccache invocations that include LD_PRELOAD; review auditd or EDR records for unexpected shared-library loads by the sccache server process; correlate with subsequent privilege changes or root-owned process spawns.

What your security team should do

• Immediately audit all Linux hosts for sccache installed via snap and remove or replace it
• Enforce least-privilege execution for any remaining sccache instances
• Add sccache binary paths and LD_PRELOAD usage to endpoint monitoring rules
• Block new installations of the vulnerable snap until a fixed package is available