Cyber Resilience

CVE-2015-3246

Race Condition in Redhat Libuser ≤ 0.56.13-5

CISA KEVActive ExploitationEUVD ExploitedPublic PoCRace Condition
Published
11 August 2015
Modified
26 August 2026
KEV Added
26 August 2026
CVSS Score v3.1 5.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.071 94th percentile
Risk Priority 75 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2015-3246 is a medium-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Redhat Libuser. Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 6% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification.…

more

NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

CWE(s)
CWE-264CWE-367
KEV Date Added
26 August 2026

Related Threats

MITRE ATT&CK Enterprise Techniques

T1034 Path Interception Persistence
**This technique has been deprecated.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
T1574 Hijack Execution Flow Stealth
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2011-4316Same vendor: Redhat
CVE-2014-3521Same vendor: Redhat
CVE-2013-2165Same vendor: Redhat
CVE-2014-0018Same vendor: Redhat
CVE-2014-7827Same vendor: Redhat
CVE-2012-6120Same vendor: Redhat
CVE-2014-3472Same vendor: Redhat
CVE-2010-1429Same vendor: Redhat
CVE-2014-0071Same vendor: Redhat
CVE-2012-3369Same vendor: Redhat

Affected Assets

redhat
libuser
0.60-1, 0.60-2, 0.60-3, 0.60-4, 0.60-5 · ≤ 0.56.13-5

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V15.4.2
  • V17.2.6

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-8 Time Stamps
addresses: CWE-367

Timestamps meeting UTC or offset standards help identify TOCTOU issues through precise chronological reconstruction of check/use operations.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.

References