Listen to this Post
CVE-2015-3246 is a race condition vulnerability discovered in the libuser library, a core system component that provides a standardized interface for manipulating and administering user and group accounts on Linux systems. The library is installed by default on Linux distributions derived from Red Hat’s codebase.
The vulnerability stems from a fundamental flaw in how libuser handles updates to the `/etc/passwd` file. Traditional password management programs like passwd, chfn, and `chsh` follow a safe file-update pattern: they create a temporary copy of /etc/passwd, apply modifications to that copy, and then atomically rename the temporary file to replace the original using the `rename()` function. This approach ensures that if anything goes wrong during the modification, the original `/etc/passwd` file remains intact and consistent.
libuser, however, takes a different and dangerous approach: it modifies `/etc/passwd` directly in place. The library opens `/etc/passwd` for reading and writing (O_RDWR), acquires an fcntl() write-lock, reads the file contents into a buffer, seeks to the beginning of the target user’s line, and writes modifications directly back to the file. If any error occurs during this direct modification—such as a disk error, a signal interruption, or a concurrent access conflict—libuser may leave `/etc/passwd` in an inconsistent or corrupted state.
Compounding this issue, libuser’s fcntl() locking mechanism is incompatible with the lckpwdf() locks used by traditional password utilities from packages like shadow-utils and util-linux. This incompatibility means that libuser’s locks do not properly coordinate with other system components that might be accessing `/etc/passwd` concurrently. Additionally, glibc modules such as nss (Name Service Switch) and nscd (Name Service Cache Daemon) do not expect `/etc/passwd` to be directly modified while they are parsing its contents.
The vulnerability is exposed through SUID-root programs that use libuser, most notably `userhelper` (from the usermode package) and `chfn` (when compiled with libuser support). A local attacker can cause an error during libuser’s direct modification of /etc/passwd, corrupting the file and causing a denial of service. More critically, by combining this vulnerability with CVE-2015-3245—which allows injection of newline characters into /etc/passwd—an authenticated local user can escalate privileges to root. Qualys, the security firm that discovered the vulnerability, successfully developed a local root exploit against `userhelper` and `chfn` as proof of concept.
The vulnerability affects libuser versions before 0.56.13-8 and 0.60 before 0.60-7. Red Hat rated this vulnerability as having “Important” security impact.
DailyCVE Form:
Platform: RHEL 6, RHEL 7
Version: <0.56.13-8, <0.60-7
Vulnerability: Race condition (file corruption)
Severity: Important (CVSSv2 7.2)
Date: July 23, 2015
Prediction: Patch already released (July 23, 2015)
What Undercode Say:
Red Hat released security updates RHSA-2015:1482 (for RHEL 6) and RHSA-2015:1483 (for RHEL 7) on July 23, 2015. These updates contain backported patches that correct the libuser vulnerability. Amazon Linux also released ALAS-2015-572 on the same date. Debian addressed the issue through DLA-468-1. For Red Hat Enterprise Linux 5, which is in Production 3 Phase of its lifecycle, the issue is not planned to be addressed.
Check your libuser version with:
rpm -q libuser
Or for Debian-based systems:
dpkg -l libuser
Apply the fix on Red Hat-based systems:
sudo yum update libuser
Or for RHEL 7:
sudo yum update libuser
For Debian wheezy:
sudo apt-get update && sudo apt-get install libuser=1:0.56.9.dfsg.1-1.2+deb7u1
Verify the update:
rpm -q libuser Should show libuser-0.56.13-8.el6_7 or later
Exploit: (Educational Purposes!)
The vulnerability can be triggered by causing an error during libuser’s direct modification of `/etc/passwd` while running a SUID-root program like userhelper. An attacker can race the modification process or cause a signal interruption to leave the file in an inconsistent state. When combined with CVE-2015-3245, which allows newline injection via `userhelper -f` options, an attacker can inject arbitrary entries into /etc/passwd. The combined exploit targets `userhelper` and `chfn` (if linked with libuser).
Protection:
- Upgrade libuser to version 0.56.13-8 or later, or 0.60-7 or later
- Apply Red Hat RHSA-2015:1482 (RHEL 6) or RHSA-2015:1483 (RHEL 7)
- For Debian systems, apply DLA-468-1
- Restrict local shell access to trusted users only
- Monitor `/etc/passwd` for unexpected modifications
Impact:
- Local denial of service through `/etc/passwd` corruption
- Local privilege escalation to root when combined with CVE-2015-3245
- Affects RHEL 6, RHEL 7, and derivatives
- Incompatible locking with system utilities causes race conditions
- Public exploit available in the wild
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
