libuser CVE-2015-3246: 2015 Linux Root Bug Lands in KEV
Any RHEL or CentOS 6 or 7 host that has taken updates since July 2015 is already fixed; the real risk is forgotten legacy Linux servers, where this is one of several old root exploits attackers now chain after a web compromise.
Must act: Owners of RHEL or CentOS 5, 6 or 7 systems, old VM images, appliances or containers whose libuser package predates the July 2015 fix, most urgently internet-facing web servers where an attacker could land a shell.
Can relax: Hosts that received the 2015 errata or run maintained distributions with fixed libuser (Debian bookworm and trixie, Ubuntu 18.04 through 24.04 per Ubuntu), and systems without libuser and usermode installed.
- Find hosts that carry the vulnerable code: rpm -q libuser usermode (or dpkg -l libuser) across servers, golden images and appliances.
- Update libuser to at least the RHSA-2015:1482/1483 builds (yum update libuser), or rebuild images from a maintained base.
- Where you cannot update (RHEL 5, frozen appliances), apply Red Hat's mitigation: add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh.