CVE-2015-3246 — Red Hat Libuser | CVSS 7.2 HIGH

HIGH

CVSS 7.2 HIGH  ·  EPSS 7%  ·  Red Hat Libuser

Severity Overview

Summary

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

What the Attack Looks Like

If successfully exploited: A successful exploit grants the attacker elevated privileges on the target system — typically administrator or root — enabling full control of the affected host.

Analyst Takeaway

The attack is launched by an attacker with local access to the target system. This vulnerability is already in CISA KEV, which means exploitation has been confirmed in the wild — treat this as active risk, not theoretical exposure. The mapping indicates possible privilege escalation behavior, so local admin and kernel-level activity should be reviewed if compromise is suspected. In parallel with patching, defenders should review external exposure, hunt for signs of exploitation, and validate whether compensating controls are in place for vulnerable assets.

MITRE ATT&CK Mapping

• T1195.002 – Compromise Software Supply Chain
  Rationale: The vulnerability context suggests compromise of software or its delivery/update path.
• T1068 – Exploitation for Privilege Escalation
  Rationale: The vulnerability context indicates local or kernel-level privilege escalation behavior.

Detection Guidance

• T1195.002 — Software Supply Chain Compromise
  • Validate integrity of software updates, packages, and repositories associated with the affected product against known-good vendor hashes.
  • Review CI/CD pipeline activity, build logs, and package download history for anomalies around the vulnerability disclosure window.
  • Confirm software was sourced from official vendor channels and that update infrastructure communications match expected vendor endpoints.
• T1068 — Exploitation for Privilege Escalation
  • Monitor for unexpected privilege changes, token manipulation, or process execution under SYSTEM or root that is not consistent with your baseline.
  • Review service creation (Event ID 7045), scheduled task creation (Event ID 4698), and kernel driver load events for unexpected entries.
  • Inspect EDR kernel-level alerts and OS-level memory protection violations associated with the vulnerable host or process.

Hunting Considerations

These are proactive hunts mapped to the ATT&CK techniques identified for this CVE. Run them now — do not wait for an alert to fire.

• T1195.002 — Software Supply Chain Compromise
  • Binary integrity: Compare hashes of recently updated software packages and executables against known-good values from the vendor’s official release. Unexpected hash changes in software update paths are the primary supply chain indicator.
  • Build system activity: Review CI/CD pipeline logs for unexpected jobs, unauthorized commits, changes to build scripts, or outbound network connections from build servers to external IPs not in your allowlist.
  • Update server communications: Flag connections to update endpoints that do not resolve to known vendor infrastructure. Supply chain attacks commonly involve redirecting update traffic to attacker-controlled servers.
  • Prioritize recently updated systems: Identify all hosts running the affected product version and focus investigation on those that applied updates during the window of potential compromise — an update received during an active supply chain attack is the highest-risk scenario.
• T1068 — Exploitation for Privilege Escalation
  • Privilege assignment events (Windows): Search for Event ID 4672 (Special Privileges Assigned to New Logon) for accounts that should not hold elevated rights. Correlate with Event ID 4688 (process creation) to see what ran immediately after the privilege was granted.
  • Unexpected SYSTEM/root processes: Hunt for processes running as NT AUTHORITY\SYSTEM or root that are not part of your baseline — particularly interactive shells (cmd.exe, PowerShell, bash) or network utilities running at that privilege level.
  • Service and driver installation (Windows): Event ID 7045 (new service installed) and kernel driver load events are key. Privilege escalation exploits frequently install a service or load a driver as the escalation mechanism — any unexpected entry here warrants investigation.
  • Linux-specific indicators: Search auditd for unexpected setuid/setgid executions, sudo invocations by users outside your admin group, and privilege-change syscalls (setuid, setreuid, setresuid) from non-root processes.
  • Token manipulation (Windows): Sysmon Event 10 (process access) targeting lsass.exe or other high-privilege processes often precedes or accompanies privilege escalation. Unusual OpenProcess calls against security processes are a strong signal.

Recommended Actions

Immediate (0–24 Hours)

• Inventory: Identify all systems running Red Hat Libuser. Include production, staging, dev, and cloud environments — untracked instances are the most likely to remain unpatched.
• Review local access scope: This vulnerability requires local access — assess which users or processes have local access to affected systems and whether that access could be reached from a compromised adjacent host.
• Verify software integrity: Before applying updates, confirm that software packages and update mechanisms have not been tampered with. Compare hashes against vendor-published values.

Remediation

• Apply the vendor patch: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
• CISA directive deadline: 2026-09-09 — this is the mandatory deadline for US federal civilian agencies under BOD 22-01. All organizations should treat this date as a strong target regardless of federal mandate.
• Verify remediation: After patching, confirm the correct version is installed on all affected hosts. Run a vulnerability scan or use your asset management tooling to verify — do not rely solely on change tickets.
• Post-patch compromise assessment: Privilege escalation and lateral movement techniques can result in persistent access that survives patching. After remediation, review the hunting considerations in this alert to assess whether compromise occurred before the patch was applied.

Detection Coverage

• Verify ATT&CK coverage: Confirm your SIEM and EDR have detection logic in place for T1195.002, T1068. Review the Detection Guidance and Hunting Considerations sections of this alert for the specific log sources and behavioral patterns to monitor.
• Threat intelligence feeds: Monitor your TI feeds and vendor advisory channels for published indicators of compromise (IOCs), proof-of-concept exploit releases, or active campaign reporting associated with this CVE — these should trigger an immediate hunt even if no internal alerts have fired.

Detection Playbooks

Vulnerability Details

Additional Notes

This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: https://access.redhat.com/articles/1537873 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2015-3246