libuser privilege escalation via userhelper (CVE-2015-3246)

Actively exploited in the wild - CVE-2015-3246 is a high-severity local privilege escalation in libuser before 0.56.13-8 and 0.60 before 0.60-7 (as used in the userhelper program in usermode) that lets local users corrupt /etc/passwd and, when chained with CVE-2015-3245, gain root privileges. Patched versions are available - update immediately.

Overview

CVE-2015-3246 is a file-handling vulnerability in libuser, a library used by the userhelper program in the usermode package on Linux systems. When libuser modifies the /etc/passwd file, it does so directly rather than using a safe temporary-file-and-rename pattern. If an error occurs during this modification - which a local attacker can deliberately trigger - the file can be left in an inconsistent, corrupted state.

On its own, this causes a denial of service: the system’s user database becomes unreadable, breaking login, authentication, and account management. More concerning, the same corrupt-file primitive is the second half of a privilege-escalation chain. Combined with CVE-2015-3245 (a separate libuser issue), an attacker can craft the corrupted state to inject their own entries into /etc/passwd, effectively granting themselves root or a root-equivalent account.

The CVSS score is 7.2 (High). The attack vector is local only, requires no prior privileges, and needs no user interaction. However, the attack complexity is rated High because the exploitation sequence requires careful control of the file state and depends on chaining the second CVE.

Impact

• Local denial of service: an unprivileged user can crash or corrupt the system’s authentication database, locking out all users.
• Local privilege escalation: when chained with CVE-2015-3245, an attacker without any prior access can achieve root-level control of the machine.
• Persistence: a root account injected via corrupted /etc/passwd survives reboots and is difficult to detect without auditing the file contents.

CISA has confirmed this vulnerability is actively exploited in the wild, and the EPSS model estimates a 7.1% probability of exploitation in the next 30 days - a meaningful figure for a local-vector issue. Any multi-user system running the affected libuser versions should be treated as at risk.

Remediation

Update libuser to 0.56.13-8 or later (for the 0.56 branch) or to 0.60-7 or later (for the 0.60 branch). These versions introduce proper atomic file replacement, closing both the corruption primitive and the chained escalation path.

For immediate mitigation if patching is not possible:

• Restrict local access to trusted users only; the attack requires the ability to run code locally.
• Monitor /etc/passwd for unexpected changes or corruption events.
• Review the usermode package configuration; if userhelper is not required, disable or remove it.

Also verify that CVE-2015-3245 is addressed in your distribution’s updates, since the two issues are designed to work together.

Security Insight

This pair of vulnerabilities is a textbook example of why privilege-escalation bugs are rarely single-shot exploits - attackers chain file-state corruption with a second logic flaw to turn a denial of service into full root access. The pattern of modifying critical system files in place rather than atomically has been a persistent source of Linux privilege-escalation bugs for over a decade. It also underscores that high-complexity local attacks remain attractive targets once they enter exploit kits: CISA’s inclusion on the Known Exploited Vulnerabilities list means real-world attackers have operationalized this chain, not just theorized about it.

For ongoing coverage of exploitation trends, see our security news section, and for details on past incidents involving similar local-privilege-escalation chains, consult our breach reports.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs