---
title: "libuser CVE-2015-3246: 2015 Linux Root Bug Lands in KEV"
url: https://erroneo.us/security/briefs/libuser-userhelper-passwd-race-cve-2015-3246/
description: "A 2015 libuser /etc/passwd race gives local root on old RHEL/CentOS. Talos saw it in 2026 intrusions; CISA added it to KEV. Fixed since July 2015."
type: security-brief
section: "Security Digest"
date_published: 2015-07-23
date_modified: 2026-08-26
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Most can relax"
cves: ["CVE-2015-3246"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# libuser CVE-2015-3246: 2015 Linux Root Bug Lands in KEV

**Verdict: Most can relax.** Any RHEL or CentOS 6 or 7 host that has taken updates since July 2015 is already fixed; the real risk is forgotten legacy Linux servers, where this is one of several old root exploits attackers now chain after a web compromise.

- **Who must act:** Owners of RHEL or CentOS 5, 6 or 7 systems, old VM images, appliances or containers whose libuser package predates the July 2015 fix, most urgently internet-facing web servers where an attacker could land a shell.
- **Who can relax:** Hosts that received the 2015 errata or run maintained distributions with fixed libuser (Debian bookworm and trixie, Ubuntu 18.04 through 24.04 per Ubuntu), and systems without libuser and usermode installed.
- **Affected:** libuser before 0.56.13-8 (RHEL 6 line); libuser 0.60 before 0.60-7 (RHEL 7 line); RHEL 5 libuser (Red Hat does not plan a fix); Ubuntu 16.04 libuser (listed as vulnerable by Ubuntu)
- **Fixed:** RHEL 6: libuser-0.56.13-8.el6_7 (RHSA-2015:1482); RHEL 7: libuser-0.60-7.el7_1 (RHSA-2015:1483); Ubuntu 14.04: 1:0.56.9.dfsg.1-1.2ubuntu2+esm1 (Ubuntu Pro); Debian bookworm 1:0.64~dfsg-1 and trixie 1:0.64+git20241106~dfsg-3 (listed fixed)
- **CVEs:** CVE-2015-3246
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Find hosts that carry the vulnerable code: rpm -q libuser usermode (or dpkg -l libuser) across servers, golden images and appliances.
2. Update libuser to at least the RHSA-2015:1482/1483 builds (yum update libuser), or rebuild images from a maintained base.
3. Where you cannot update (RHEL 5, frozen appliances), apply Red Hat's mitigation: add pam_warn and pam_deny rules to /etc/pam.d/chfn and /etc/pam.d/chsh.
4. Prioritize legacy internet-facing web servers: patch the web stack, or retire or isolate them, because a web foothold is what makes this local bug matter.
5. On the same hosts, check the other old root exploits Talos listed, such as sudo CVE-2021-3156 and Dirty Pipe CVE-2022-0847.

### How to check if you are affected

- Check /etc/passwd for damage or additions: awk -F: '$3==0' /etc/passwd should list only root; diff it against /etc/passwd- and backups.
- Search /var/log/secure for chfn, chsh or userhelper activity by service accounts such as apache or nginx; the public exploit repeatedly rewrites the attacker's GECOS field.
- Hunt for the web shells and implants from the UAT-10147 campaign (BadIIS, QuasarRAT and others) using Talos's published IOCs, ClamAV signatures and Snort SIDs 1:66696 and 1:66697.

## What happened

On July 23, 2015, Qualys published an [advisory](https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt) on two bugs in libuser, the account-management library used by Red Hat-derived Linux distributions. Red Hat shipped fixes the same day. CVE-2015-3246 is a race in how libuser rewrites `/etc/passwd`: it edits the file in place instead of writing a temporary copy and renaming it, so a failed change can leave the file corrupted. Qualys turned it into a local root exploit against `userhelper`, "a setuid-root program from the usermode package," and, with some changes, against `chfn`. It called its proof of concept "our public roothelper.c". The companion bug CVE-2015-3245 lets newlines into the GECOS field. Red Hat rated 3246 Important and 3245 Moderate.

Eleven years later, on August 20, 2026, Cisco [Talos](https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/) described UAT-10147, a Chinese-speaking, financially motivated group running SEO fraud and data theft. Talos says the group leans on agentic AI to refine and validate exploits. It breaks into Windows and Linux web servers through one-day RCE bugs and then escalates with a kit of six Linux privilege-escalation exploits, CVE-2015-3246 among them. Talos found a target list of about 170,000 URLs and victims in government, education, media, technology and gaming. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246) on August 26, 2026, with a September 9 federal deadline.

## Who is affected

The [CVE record](https://www.cve.org/CVERecord?id=CVE-2015-3246) lists libuser before 0.56.13-8 and 0.60 before 0.60-7. Per the Red Hat [article](https://access.redhat.com/articles/1537873), every libuser shipped with RHEL 6 and 7 was affected until [RHSA-2015:1482](https://access.redhat.com/errata/RHSA-2015:1482) (libuser-0.56.13-8.el6_7) and [RHSA-2015:1483](https://access.redhat.com/errata/RHSA-2015:1483) (libuser-0.60-7.el7_1). RHEL 5 is affected and, per Red Hat's [CVE page](https://access.redhat.com/security/cve/cve-2015-3246), will not be fixed. In 2015 Red Hat also flagged vulnerable copies in its container, cloud and appliance images. [Ubuntu](https://ubuntu.com/security/CVE-2015-3246) marks 18.04 through 24.10 as not affected, 16.04 as vulnerable and 14.04 as fixed through Ubuntu Pro. The [Debian tracker](https://security-tracker.debian.org/tracker/CVE-2015-3246) lists bookworm and trixie as fixed.

## Do you really need to act?

For most teams, no. This is a local bug, and Red Hat notes the attacker needs an account listed in `/etc/passwd` and that account's password. LDAP-only accounts and system accounts without a valid password cannot use it. Any RHEL or CentOS 6 or 7 machine patched at any point since mid-2015 is fixed.

The KEV listing matters for one population: old Red Hat-family servers that nobody patches, especially web servers. In the Talos campaign, the web exploit gets the attacker in and these old privilege-escalation bugs turn that foothold into root. If you have such machines, this is the least of their problems. Treat the KEV entry as a prompt to find them.

## What to do now

1. Inventory: `rpm -q libuser usermode` on Red Hat-family hosts, `dpkg -l libuser` elsewhere, including golden images and vendor appliances.
2. Patch: `yum update libuser`, or rebuild from a maintained base image. Confirm the version is at least `0.56.13-8.el6_7` or `0.60-7.el7_1`.
3. Cannot patch (RHEL 5, frozen appliances)? Apply Red Hat's mitigation by adding `pam_warn.so` and `pam_deny.so` rules to `/etc/pam.d/chfn` and `/etc/pam.d/chsh`. This blocks unprivileged use of chfn, chsh and the matching userhelper functions.
4. Fix the front door: patch, isolate or retire legacy internet-facing web servers.
5. Check the same hosts for the other old root bugs Talos lists, including sudo CVE-2021-3156 and Dirty Pipe CVE-2022-0847.

## How to tell if you were hit

Look at `/etc/passwd` first. `awk -F: '$3==0' /etc/passwd` should print only root. Diff the file against `/etc/passwd-` and your backups for new users, changed shells or mangled lines. The public exploit works by rewriting the attacker's GECOS field over and over, so search `/var/log/secure` for bursts of chfn, chsh or userhelper activity, especially from web service accounts. With the PAM mitigation in place, Red Hat says blocked attempts are logged there by default. Talos publishes ClamAV signatures, Snort SIDs 1:66696 and 1:66697, and an IOC list for the wider campaign. Use them to hunt for web shells and implants such as BadIIS and QuasarRAT. A host rooted this way should be rebuilt, not cleaned.

## Timeline

- Jul 23, 2015 — Qualys discloses CVE-2015-3245 and CVE-2015-3246, and Red Hat ships RHSA-2015:1482 and RHSA-2015:1483.
- Aug 11, 2015 — The CVE record is published.
- Aug 20, 2026 — Cisco Talos reports UAT-10147 using CVE-2015-3246 for Linux privilege escalation.
- Aug 26, 2026 — CISA adds CVE-2015-3246 to KEV, with a federal due date of September 9.

## Sources

1. [Red Hat — libuser vulnerabilities (CVE-2015-3245 and CVE-2015-3246)](https://access.redhat.com/articles/1537873)
2. [Qualys — Security advisory CVE-2015-3245 / CVE-2015-3246](https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt)
3. [Red Hat — RHSA-2015:1482 libuser security update (RHEL 6)](https://access.redhat.com/errata/RHSA-2015:1482)
4. [Red Hat — RHSA-2015:1483 libuser security update (RHEL 7)](https://access.redhat.com/errata/RHSA-2015:1483)
5. [Red Hat — CVE-2015-3246](https://access.redhat.com/security/cve/cve-2015-3246)
6. [CVE record — CVE-2015-3246](https://www.cve.org/CVERecord?id=CVE-2015-3246)
7. [CISA — Known Exploited Vulnerabilities: CVE-2015-3246](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-3246)
8. [Cisco Talos — UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations](https://blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/)
9. [Ubuntu — CVE-2015-3246](https://ubuntu.com/security/CVE-2015-3246)
10. [Debian security tracker — CVE-2015-3246](https://security-tracker.debian.org/tracker/CVE-2015-3246)

---
Source page: https://erroneo.us/security/briefs/libuser-userhelper-passwd-race-cve-2015-3246/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt