PatchTheCVECVE-2015-3246: Red Hat Libuser Race Condition Vulnerability
85
Patch now
HIGH 7.4EXPLOITEDWATCHLISTMITIGATEMITIGATEUPGRADE
CVE-2015-3246 is a high-severity flaw (CVSS 7.4) affecting enterprise linux, opensuse, libuser, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.
Why this priority
- High severity
- EPSS top 5%: very likely to be exploited
- Exploited in the wild (CISA KEV)
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Am I affected?
Timeline
- Published CVE record published
- Exploited Added to the CISA Known Exploited Vulnerabilities list
- Deadline CISA due date for US federal agencies to patch
- Updated Record last modified
redhat enterprise linux MITIGATE
Affected: 5.0 · 6.0 · 7.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 5.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
opensuse opensuse MITIGATE
Affected: 13.2
Fixed in: no fixed release known
Safe to downgrade to: a release before 13.2
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
libuser project libuser UPGRADE
Affected: < 0.56.13-8 · >= 0.60 and < 0.60-7
Fixed in: 0.56.13-8, 0.60-7
Safe to downgrade to: a release before 0.60
1. Check installed version
apt-cache policy libuser || rpm -q libuser || libuser --version
2. UPGRADE to 0.56.13-8 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade libuser
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade libuser
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 0.60 (Debian / Ubuntu)
apt-cache madison libuser
sudo apt install libuser=<VERSION_BEFORE_0.60>
sudo apt-mark hold libuser
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list libuser
sudo dnf downgrade libuser-<VERSION_BEFORE_0.60>
sudo dnf versionlock add libuser
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · python-streamlink · FIXED · 8.6.2-1.fc46 · FEDORA-2026-a56fcfdc08 · source
sudo dnf upgrade --advisory=FEDORA-2026-a56fcfdc08
Fedora ELN · valgrind · FIXED · 3.28.0-1.eln159 · FEDORA-2026-c593ef1d15 · source
sudo dnf upgrade --advisory=FEDORA-2026-c593ef1d15
Ubuntu 20.04 · libuser · NOT AFFECTED
Ubuntu 22.04 · libuser · NOT AFFECTED
Ubuntu 24.04 · libuser · NOT AFFECTED
Ubuntu 24.10 · libuser · NOT AFFECTED
Debian 12 · libuser · FIXED · 1:0.62~dfsg-0.1
sudo apt update && sudo apt install --only-upgrade libuser
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libuser)" ge "1:0.62~dfsg-0.1" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · libuser · FIXED · 1:0.62~dfsg-0.1
sudo apt update && sudo apt install --only-upgrade libuser
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libuser)" ge "1:0.62~dfsg-0.1" && echo PATCHED || echo STILL-VULNERABLE
RHEL 6 · libuser · FIXED · libuser-0.56.13-8.el6_7
sudo dnf upgrade --advisory=RHSA-2015:1482
rpm -q libuser
RHEL 7 · libuser · FIXED · libuser-0.60-7.ael7b_1
sudo dnf upgrade --advisory=RHSA-2015:1483
rpm -q libuser
RHEL 5 · libuser · DEFERRED
sudo yum update --advisory=ALAS-2015-572
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- GitHub PoC: HORKimhab/CVE-2015-3246 (0 stars)
- Write-up: blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into
- Write-up: www.exploit-db.com/exploits/44633/
- Write-up: www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt
- Exploit-DB: Libuser Library - Multiple Vulnerabilities
- Exploit-DB: Libuser - 'roothelper' Local Privilege Escalation (Metasploit)
- Metasploit: Libuser roothelper Privilege Escalation
Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2023-30549 HIGH 7.1 UPGRADE MITIGATE Apptainer is an open source container platform for Linux
- CVE-2023-6915 MEDIUM 6.2 MITIGATE DOWNGRADE A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel
- CVE-2026-71227 MEDIUM 5.1 MITIGATE DOWNGRADE A flaw was found in libkcapi
- CVE-2026-71226 HIGH 7.3 MITIGATE DOWNGRADE Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error befor
- CVE-2026-71225 MEDIUM 6.5 MITIGATE DOWNGRADE A flaw was found in libkcapi