CVE-2015-3246

What is libuser?

libuser is a Red Hat–developed C library that provides a standardized interface for reading and modifying the system account databases — chiefly /etc/passwd and /etc/shadow. It backs several setuid-root administrative helpers shipped on Red Hat Enterprise Linux, Fedora, and CentOS, most notably the userhelper/chfn/chsh tools in the usermode package. Because those helpers run with root privileges while acting on input supplied by unprivileged users, any flaw in how libuser serialises account records becomes a local privilege-escalation surface.

Overview

CVE-2015-3246 is one of two libuser flaws disclosed together by Qualys in its "Roots" advisory. The library modifies /etc/passwd in a way that is not atomic and does not adequately guard against a user-controlled entry corrupting the file. A local, authenticated user can leverage the resulting inconsistent state to cause a denial of service (a corrupted /etc/passwd can lock all users, including root, out of the system) and — when chained with the companion newline-injection flaw CVE-2015-3245 — to escalate to full root privileges.

Qualys demonstrated a working local root exploit ("roots") that combined CVE-2015-3245 and CVE-2015-3246 against a default Red Hat / CentOS install, which is why CISA has now added the pair-enabling flaw to the KEV catalog despite its modest standalone CVSS score.

Affected Versions

The usermode package (userhelper, chfn, chsh) must be updated alongside libuser, because those setuid binaries are the exposed callers.

Technical Details

The root cause is improper handling of the account-database write (CWE-264, privilege management). libuser rewrites the entire /etc/passwd//etc/shadow file rather than editing a single field atomically, and it fails to reject entries that a lower-privileged caller has manipulated. A user who can influence a field written back through a setuid libuser consumer can cause the file to be written in a corrupted or attacker-influenced state. The high attack complexity (AC:H) reflects the race/timing element and the need to combine it with the CVE-2015-3245 newline injection to reach code execution rather than just denial of service.

Discovery

Both libuser vulnerabilities were discovered and responsibly disclosed by the Qualys Security Advisory team, published on 23 July 2015 as the "Roots" advisory, alongside a proof-of-concept local root exploit.

Exploitation Context

The Qualys advisory shipped with a reliable local-root proof of concept, and the flaw pair has been public for a decade, making exploit code trivially available. CISA's August 2026 KEV addition indicates evidence of active exploitation against unpatched, long-lived Red Hat / CentOS 6 and 7 systems — an environment where end-of-life hosts running the original libuser are still common. Exploitation requires an existing local account, so this is a post-compromise privilege-escalation primitive rather than an initial-access vector.

Remediation

1. Patch libuser and usermode together to the fixed package versions above (yum update libuser usermode). Updating only one leaves the exploit chain intact.
2. For end-of-life RHEL/CentOS 6 hosts, migrate to a supported distribution; no upstream fix is available for EoL releases.
3. Restrict local account access on multi-user systems and audit who holds shell access, since exploitation requires a local login.
4. Review /etc/passwd and /etc/shadow integrity (e.g. via pwck, file-integrity monitoring) on systems that may have been exposed, and watch for unexpected UID 0 entries.
5. Audit for local privilege-escalation indicators — new setuid files, unexpected root shells, and modifications to account databases outside change windows.