In the configurations of the DHCP server Kea, developed by the ISC consortium as a replacement for the traditional ISC DHCP, vulnerabilities have been identified that may allow a local user to execute code with root privileges or overwrite any file on the system in certain situations.
- CVE-2025-32801 – allows a local user to gain root privileges on systems where Kea runs under the root user, or to gain full control over the Kea server in systems running Kea under a user with limited privileges. The attack is conducted through interaction with the REST API provided by the kea-ctrl-agent service, which by default accepts requests via localhost:8000. In most configurations, the REST API is accessible to all local users of the system without authentication.
Exploitation occurs by sending the set-config command, which allows the management of settings for all of Kea's services. Among other things, the command can be used to change the 'hooks-libraries' parameter, which affects the loading of additional handler libraries. An attacker can achieve the execution of their code within the context of Kea's services by substituting their library, the function with the 'constructor' attribute of which will be invoked when the library is opened by the dlopen() function. curl -X POST -H 'Content-Type: application/json' \ -d '{ "command": "config-set", "arguments": { "Control-agent": {"hooks-libraries": [{"library": "/home/someuser/libexploit.so"}] }}}' \ localhost:8000
- CVE-2025-32802 – this vulnerability allows the use of the config-write command in the REST API to overwrite any file in the system, subject to the permissions of the user under which Kea is running. The attacker can control the written content, but the data is written in JSON format and must include valid Kea settings. Nevertheless, it cannot be ruled out that this might be sufficient to execute commands with root privileges by manipulating files in the /etc/profile.d directory. curl -X POST -H 'Content-Type: application/json' \ -d '{ "command": "config-write", "arguments": { "filename": "/etc/evil.conf" } }' \ localhost:8000
Several use cases for the config-write command to modify Kea settings are mentioned. For example, you can redirect log files to any location in the file system, organize spooling of UNIX socket services, or block the operation of Kea.
- CVE-2025-32803 — logs (/var/log/kea*.log) as well as files /var/lib/kea/*.cvs containing binding information (the key to connect to is specified, and iroh finds the associated host and establishes an encrypted connection using the QUIC protocol). Direct P2P connections are established whenever possible, but if not, it falls back to using relays, which are also employed for host discovery by keys. You can run your own relay or connect to public relays supported by the community. (DHCP lease) and associated data are available for read access by all.
Running Kea with root privileges is practiced in Arch Linux, Gentoo, openSUSE Tumbleweed (up to May 23), FreeBSD, NetBSD (pkgsrc), and OpenBSD distributions. In Debian, Ubuntu, and Fedora, the service runs under a separate unprivileged user. In Gentoo, the Kea package is only available in the unstable repository for the amd64 architecture. In Ubuntu, unlike other systems, the kea-ctrl-agent service was started only if REST API access settings specified a password. You can track package update publications in the distributions on the pages: Debian, Ubuntu, RHEL, openSUSE, Fedora, Gentoo, ALT Linux, Arch, FreeBSD, OpenBSD, and NetBSD.
Additionally, a vulnerability (CVE-2025-23394) is noted, manifesting in the Cyrus IMAP server package provided by the openSUSE project in the Tumbleweed and Factory repositories. The vulnerability allows a local user to escalate privileges from the cyrus user to root. The vulnerability has been assigned a critical severity level (9.8 out of 10), but this rating is unjustifiably high because an attack requires rights of the cyrus user, which can be obtained through exploiting another vulnerability in cyrus-imapd.
The issue is caused by an error while handling symbolic links in the daily-backup.sh script, specific to SUSE/openSUSE distributions. The essence of the vulnerability is that the daily-backup.sh script runs with root privileges but writes to the /var/lib/imap directory, where an unprivileged user cyrus can create files. The attack involves creating a symbolic link pointing to a system file (for example, a symbolic link /var/lib/imap/mailboxes.txt pointing to /etc/shadow). The vulnerability has been fixed in version 3.8.4-2.1 of the cyrus-imapd package.
Source: opennet.ru
