Loading a malicious hook library can lead to local privilege escalation

The primary impact of CVE-2025-32801 is the potential for an attacker to gain root privileges on the system hosting the Kea DHCP server. This is particularly concerning because many Kea deployments run as root and expose API entry points without proper security controls. Successful exploitation could allow an attacker to modify DHCP configurations, redirect network traffic, compromise other systems on the network, and potentially achieve complete control over the affected server. The ease of exploitation is amplified by the default insecure configurations often found in Kea installations, such as placing control sockets in accessible locations.

Organizations running Kea DHCP servers in environments with default configurations, particularly those running as root and exposing API endpoints without proper access controls, are at significant risk. Shared hosting environments where multiple users share a Kea instance are also vulnerable, as a compromised user could potentially exploit the API to escalate privileges.

• linux / server:

journalctl -u kea -g 'malicious hook library'

• linux / server:

lsof -i :67 -p $(pidof kea)

• linux / server:

ps aux | grep kea | grep -i hook

1. 2025-05-28Disclosure

   disclosure

1. Gereserveerd2025-04-10
2. Gepubliceerd2025-05-28
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-32801 is to upgrade to Kea version 2.7.9 or later. Prior to upgrading, assess the impact on dependent systems and plan a rollback strategy if necessary. Review Kea's API configuration and restrict access to authorized clients only. Ensure control sockets are not accessible from untrusted networks. Implement network segmentation to limit the blast radius of a potential compromise. Consider using a Web Application Firewall (WAF) to filter malicious requests targeting the Kea API. After upgrading, verify the fix by attempting to load a malicious hook library via the API and confirming that the attempt is denied.