SUSE-SU-2023:2637-1: Security update for sccache

Q: What exploitation conditions are identified for the code-injection issue?

The issue is described as possible code injection through LD_PRELOAD to the sccache server. The provided information does not specify required privileges, remote access requirements, or a particular deployment configuration.

Q: What is the impact of the second vulnerability addressed by this update?

CVE-2022-31394 is a denial-of-service vulnerability involving header list size. The provided information does not state how an oversized header list is delivered or which sccache interfaces process it.

Q: Which SUSE products and architectures are listed as affected?

The update lists sccache and sccache-debuginfo for openSUSE Leap 15.3 on aarch64, ppc64le, s390x, x86_64, and i586, plus selected SUSE 15 SP3 products on the architectures specified in the advisory. These include Development Tools Module 15-SP5, HPC ESPOS 15 SP3, HPC LTSS 15 SP3, Real Time 15 SP3, and SLES 15 SP3 LTSS.

Published Feb 27, 2024

Updated

This update for sccache fixes the following issues: CVE-2023-1521: Fixed possible code injection via LDPRELOAD to sccache server (bsc#1212407). CVE-2022-31394: Fixed a denial-of-service vulnerability via header list size (bsc#1208553).

Affected Software

24 affected componentsFixes available

All of the following

SUSE openSUSE Leap 15.3 (aarch64 ppc64le s390x x86_64 i586)

Any of the following

suse/sccache-debuginfo<0.4.1

0.4.1

suse/sccache<0.4.1

0.4.1

All of the following

SUSE Development Tools Module 15-SP5 (ppc64le s390x)

Any of the following

suse/sccache-debuginfo<0.4.1

0.4.1

suse/sccache<0.4.1

0.4.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (aarch64 x86_64)

Any of the following

suse/sccache-debuginfo<0.4.1

0.4.1

suse/sccache<0.4.1

0.4.1

All of the following

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64)

Any of the following

suse/sccache-debuginfo<0.4.1

0.4.1

suse/sccache<0.4.1

0.4.1

All of the following

SUSE SUSE Linux Enterprise Real Time 15 SP3 (x86_64)

Any of the following

suse/sccache-debuginfo<0.4.1

0.4.1

suse/sccache<0.4.1

0.4.1

All of the following

SUSE SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 x86_64)

Any of the following

suse/sccache-debuginfo<0.4.1

0.4.1

suse/sccache<0.4.1

0.4.1

All of the following

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP3 (x86_64)

Any of the following

suse/sccache-debuginfo<0.4.1

0.4.1

suse/sccache<0.4.1

0.4.1

All of the following

SUSE SUSE Enterprise Storage 7.1 (aarch64 x86_64)

Any of the following

suse/sccache-debuginfo<0.4.1

0.4.1

suse/sccache<0.4.1

0.4.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/sccache-debuginfo to a version that resolves this vulnerability.
Fixed in 0.4.1
Upgrade
Upgrade suse/sccache to a version that resolves this vulnerability.
Fixed in 0.4.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-2023-2637=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Development-Tools-15-SP5-2023-2637=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-ESPOS-2023-2637=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2023-2637=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-RT-15-SP3-2023-2637=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2023-2637=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2023-2637=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2023-2637=1

Event History

Feb 27, 2024

Advisory Published

via SUSE·12:02 PM

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What exploitation conditions are identified for the code-injection issue?

The issue is described as possible code injection through LD_PRELOAD to the sccache server. The provided information does not specify required privileges, remote access requirements, or a particular deployment configuration.

What is the impact of the second vulnerability addressed by this update?

CVE-2022-31394 is a denial-of-service vulnerability involving header list size. The provided information does not state how an oversized header list is delivered or which sccache interfaces process it.

Which SUSE products and architectures are listed as affected?

The update lists sccache and sccache-debuginfo for openSUSE Leap 15.3 on aarch64, ppc64le, s390x, x86_64, and i586, plus selected SUSE 15 SP3 products on the architectures specified in the advisory. These include Development Tools Module 15-SP5, HPC ESPOS 15 SP3, HPC LTSS 15 SP3, Real Time 15 SP3, and SLES 15 SP3 LTSS.

SUSE-SU-2023:2637-1: Security update for sccache

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What exploitation conditions are identified for the code-injection issue?

What is the impact of the second vulnerability addressed by this update?

Which SUSE products and architectures are listed as affected?

Company

Resources

Contact

Frequently Asked Questions

What exploitation conditions are identified for the code-injection issue?

What is the impact of the second vulnerability addressed by this update?

Which SUSE products and architectures are listed as affected?