[HIGH PRIORITY] Red Hat libuser Race Condition LPE (CVE-2015-3246)

⚠ HIGH PRIORITY — CISA KEV (Aug 26, 2026). CVE-2015-3246 is a race condition in Red Hat libuser. Authenticated local users corrupt /etc/passwd to cause denial of service or escalate to root — actively exploited in UAT-10147 campaign chains after initial web access.

Affected libuser

• libuser before 0.56.13-8 (0.56 branch)
• libuser 0.60 before 0.60-7
• RHEL/CentOS/Fedora systems with libuser-based user management tools

Check version

rpm -q libuser 2>/dev/null
dpkg -l libuser 2>/dev/null
grep -v '^#' /etc/passwd | awk -F: '$3==0 {print}'

Patching Method

1. Update libuser: dnf update libuser or apply vendor security advisory.
2. Verify package version meets fixed thresholds (0.56.13-8+ or 0.60-7+).
3. Inspect /etc/passwd and /etc/shadow for unauthorized UID 0 entries.
4. Remove libuser if not required: dnf remove libuser.
5. Restore passwd from backup if corruption detected.
6. Rotate root password if unauthorized UID 0 account found.
7. Enable file integrity monitoring on /etc/passwd and /etc/shadow.

dnf update libuser -y
awk -F: '($3==0){print $1}' /etc/passwd

Until patched

• Restrict shell access for untrusted local accounts
• Immutable flag on /etc/passwd where compatible: chattr +i /etc/passwd (temporary)
• Prioritize patch on Linux hosts with existing web-shell indicators

CVSS: 5.1 Medium (local). Chained in active exploit campaigns.