Analysis of Local Privilege Escalation in Red Hat libuser/userhelper (CVE-2015-3245/3246)

Critical Vulnerability Information Vulnerability Overview CVE-2015-3245 userhelper chfn() newline filtering CVE-2015-3246 libuser passwd file handling Vulnerability Details Vulnerability #1 (CVE-2015-3245 userhelper chfn() newline filtering) Issue: The function in does not filter out newline characters ( ), allowing newline injection into the file, which may cause the file to be modified in unintended ways. Impact: Local Denial of Service (DoS). Although not yet successfully exploited for local root privilege escalation, there is a potential for workarounds. Vulnerability #2 (CVE-2015-3246 libuser passwd file handling) Issue: directly modifies the file without using temporary files, which may leave the file in an inconsistent state if an error occurs. Exploitation: This vulnerability was successfully exploited to achieve local root privilege escalation. Compatibility Issue: 's file locking mechanism is incompatible with other libraries (e.g., glibc), affecting operational consistency. Exploitation Overview Goal: Inject arbitrary lines into the file (e.g., the line ). Method: Exploit the function in and control the length and content of the GECOS field. Main Steps: - Create multiple forks of the process and use to prevent from failing to write certain fields. - Use fine-grained control to maximize newline injection while mitigating signals caused by library resource limits. Specific Technical Challenges and Solutions: - Field absence causing file locking conflicts. - restrictions during backup file creation. - Last-line injection issue (introducing an extra user record). - Optimization and constraints on GECOS field length and character injection. Impact and Mitigation These vulnerabilities allow local users on affected Red Hat derivatives to perform DoS attacks and privilege escalation, posing a serious threat to system security. It is recommended to promptly update to fix these issues.

Goal Reached Thanks to every supporter — we hit 100%!

Analysis of Local Privilege Escalation in Red Hat libuser/userhelper (CVE-2015-3245/3246)