CVE-2015-3246 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2015-08-11

Added to CISA KEV: 2026-08-26 4033 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: This CVE is in CISA KEV indicating active exploitation. Because it is a LOCAL privilege-escalation flaw used in post-compromise chains, review hosts for signs of prior compromise (initial access via other vectors), audit /etc/passwd integrity, and check for unauthorized root/UID-0 accounts.
Apply vendor updates immediately: upgrade libuser to >= 0.56.13-8 or >= 0.60-7 and the corresponding usermode package (RHSA-2015:1482, RHSA-2015:1483, and equivalent Fedora/openSUSE advisories).
Monitor for anomalous invocations of userhelper/usermod, sudden /etc/passwd modifications, and race-condition exploitation patterns via auditd/EDR.
Patch priority: HIGH on multi-user / shared-shell hosts and containers where untrusted local users have shell access; note this is a local escalation vector, not an internet-exposed service.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2015-3246 is a critical security vulnerability residing in the `libuser` library, specifically affecting how it handles operations on the `/etc/passwd` file ^[1]. The flaw, which involves a race condition, allows a local user to exploit applications compiled against `libuser`—such as the `userhelper` program in the `usermode` package—to corrupt the system password file ^[2]^[3]. This is a significant issue because it can lead to a complete denial of service (DoS) by rendering the system unusable or be leveraged by an attacker to escalate their privileges to root ^[1]^[3].

Exploitation

Active Exploitation: The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating that it is confirmed to be actively exploited in the wild ^[5].
Threat Actors/Campaigns: While specific attribution to threat actor groups is not widely detailed in common public security databases, the inclusion in the CISA KEV catalog underscores its use by malicious actors.
Proof-of-Concept/Exploit Tool Availability: Public exploit code and modules exist, including a Metasploit module for privilege escalation on Red Hat-based Linux systems ^[4] and an Exploit-DB entry for the DoS attack ^[6].
Attack Prerequisites: This is a local vulnerability; an attacker must already have local access to the system. No network access is required, and the attack generally does not require advanced user interaction beyond the execution of the vulnerable local binary ^[1]^[3].

Affected Products & Patches

Affected Product Versions: The flaw affects `libuser` versions before 0.56.13-8 and versions of the 0.60 branch before 0.60-7, as used by `userhelper` in the `usermode` package ^[2].
Patch Availability: Patches were released by major Linux distributions (such as Red Hat, Fedora, and CentOS) in mid-2015 to address the race condition in `libuser` ^[1]^[4].
Mitigations/Workarounds: The primary mitigation is applying the vendor-supplied security updates to the `libuser` and `usermode` packages.

Impact

Access and Capability: Successful exploitation allows an authenticated local user to corrupt the system's password database, which leads to a denial of service (DoS) or facilitates unauthorized privilege escalation to the root user ^[1]^[3].
Business Risk: For systems where untrusted local users have shell access (e.g., shared hosting, multi-user development environments, or compromised containers), this vulnerability poses a severe risk of total system compromise or service unavailability, necessitating immediate patching of all relevant `libuser` deployments.

Sources

CVE-2015-3246 - Red Hat Customer Portal
A flaw was found in the way the libuser library handled the /etc/passwd file. A local attacker could use an application compiled against libuser (for example, userhelper) to manipulate the /etc/passwd file, which could result in a denial of service or possibly allow the attacker to escalate their pr…
CVE-2015-3246 - Security Bug Tracker - Debian
Name, CVE-2015-3246. Description, libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, ...
CVE-2015-3246: Red Hat Libuser Race Condition Now ...
The vulnerability allows an authenticated local user to corrupt the /etc/passwd file, resulting in denial of service or, more critically, ...
Libuser roothelper Privilege Escalation | Metasploit Module
This module attempts to gain root privileges on Red Hat based Linux systems, including RHEL, Fedora and CentOS, by exploiting a newline injection vulnerability ...
CVE-2015-3246 · Red Hat · CVSS 9.5 · CISA KEV · CVE Brief Analyst Report
CVE-2015-3246 9.5 CISA KEV Red Hat · Libuser A race condition in the Red Hat Libuser userhelper program allows local users to cause a denial of service by corrupting the system password file. Quick facts CVSS score 9.5 (Critical) CISA KEV Listed (confirmed active exploitation) Fix available…

🟢 CVE-2015-3246