CISA Adds 2015 Red Hat Libuser Race Condition to KEV Catalog

CISA has added CVE-2015-3246, a race condition vulnerability in Red Hat's libuser library, to its Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation. The flaw allows an authenticated local user to corrupt the /etc/passwd file, leading to denial of service or privilege escalation. Red Hat's original advisory dates to 2015; the exact exploitation timeline, targeted sectors, and threat actors behind the current activity have not been disclosed.

Why It Matters

This is a decade-old vulnerability, which underscores that attackers continue to exploit unpatched legacy components long after fixes are available. Any Linux system still running a vulnerable libuser version — often bundled with user/group administration tools such as useradd, userdel, or graphical account managers — is at risk. Because exploitation requires local authenticated access, it is most relevant as a privilege-escalation step in a broader intrusion chain (e.g., after initial access via another vector) rather than a remote entry point. Ransomware use is not currently confirmed.

What Defenders Should Do

• Inventory systems for outdated libuser packages and apply the vendor patch or update to a fixed version as soon as possible.
• Since federal agencies are bound by CISA KEV remediation deadlines, prioritize this for any in-scope systems.
• Monitor for anomalous or unauthorized modifications to /etc/passwd and related user-management files, especially writes originating from non-standard processes or by low-privileged accounts.
• Audit local user account creation, modification, or privilege changes for unexpected timing or actors, particularly around use of libuser-dependent utilities.
• Treat successful exploitation as a potential privilege-escalation indicator and review for prior initial-access activity on the same host.

This is a developing item based on CISA's KEV addition; specifics on exploitation methods, actors, and scope are not yet public. See the original Red Hat advisory for technical details: https://access.redhat.com/articles/1537873.