Vulnerability record · CVE-2015-3246 · published 11 August 2015
CVE-2015-3246: libuser userhelper direct /etc/passwd write race condition
Redhat · Enterprise Linux
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used by the userhelper program in the usermode package, modifies /etc/passwd directly instead of using safe file handling. A local user who triggers an error during that modification can leave the password file in an inconsistent state. The record notes the issue can be combined with CVE-2015-3245 to gain privileges, so the file corruption is not only a denial-of-service concern.
Description
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityThe flaw is local-only with high attack complexity and medium CVSS, but it is in CISA KEV with public exploit references and can be chained to privilege escalation.
What it is
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used by the userhelper program in the usermode package, modifies /etc/passwd directly instead of using safe file handling. A local user who triggers an error during that modification can leave the password file in an inconsistent state. The record notes the issue can be combined with CVE-2015-3245 to gain privileges, so the file corruption is not only a denial-of-service concern.
Impact
An attacker gains the ability to corrupt /etc/passwd state, causing denial of service, and can chain the flaw with CVE-2015-3245 to escalate privileges.
Attack surface
The vector is local (AV:L) with no privileges required (PR:N) and no user interaction (UI:N), so any local account able to reach the userhelper path can attempt it. No remote or network path is described.
Exploitation
CVE-2015-3246 is listed in CISA KEV with a due date of 2026-09-09, and EPSS shows a 30-day probability of 0.08799 (94.9th percentile). References include an Exploit-tagged Qualys advisory and an Exploit-DB entry, indicating public exploit material exists; no ransomware use is documented.
What to do
- Patch libuser to 0.56.13-8 or later, or 0.60-7 or later, per the Red Hat RHSA-2015-1482 and RHSA-2015-1483 advisories and the openSUSE security announcement.
- Apply the vendor mitigation guidance in the Red Hat access.redhat.com article 1537873 if immediate patching is not possible.
- Restrict local shell access and limit which accounts can invoke userhelper or usermode utilities.
- Monitor and back up /etc/passwd and /etc/shadow integrity so corruption can be detected and restored quickly.
- Track CISA KEV remediation deadlines and confirm the paired fix for CVE-2015-3245 is also applied, since the two are chained.
Detection
- Alert on unexpected changes to /etc/passwd or /etc/shadow outside approved change windows, including malformed or truncated entries.
- Monitor process execution of userhelper and related usermode binaries by non-administrative local accounts.
- Correlate local authentication failures or account lockouts with recent passwd file modification events.
- Watch for the CVE-2015-3245 chain activity on the same host, such as privilege escalation attempts following passwd corruption.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2015-3246 to the Known Exploited Vulnerabilities catalog on 26 August 2026 as "Red Hat Libuser Race Condition Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 9 September 2026.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2015-3246 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2015-3246), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
