Incorrect default permissions in Kea - CVE-2025-32803

Vulnerability identifier: #VU112083

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-32803

CWE-ID: CWE-276

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information. 

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user can read the logs and lease information. 

Kea
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Fedora
Basesystem Module
Server Applications Module
openSUSE Leap
kea
kea (Red Hat package)
libkea-process74-debuginfo
libkea-dns++57-debuginfo
libkea-dhcp_ddns57-debuginfo
libkea-cryptolink50-debuginfo
kea-devel
libkea-stats41
libkea-util-io0-debuginfo
libkea-hooks100-debuginfo
libkea-process74
libkea-stats41-debuginfo
libkea-tcp19-debuginfo
libkea-asiolink72-debuginfo
libkea-d2srv47
libkea-util86-debuginfo
libkea-cryptolink50
libkea-dns++57
libkea-asiodns49-debuginfo
kea-hooks-debuginfo
libkea-util86
kea-debuginfo
libkea-log61
libkea-eval69
libkea-cfgclient66-debuginfo
libkea-exceptions33-debuginfo
libkea-dhcpsrv111
python3-kea
kea-doc
libkea-pgsql71
libkea-dhcp++92-debuginfo
libkea-asiolink72
libkea-util-io0
libkea-cc68-debuginfo
libkea-asiodns49
libkea-dhcpsrv111-debuginfo
libkea-http72
libkea-tcp19
libkea-http72-debuginfo
libkea-hooks100
libkea-pgsql71-debuginfo
libkea-database62
libkea-cc68
libkea-eval69-debuginfo
libkea-mysql71-debuginfo
kea-debugsource
libkea-cfgclient66
libkea-mysql71
libkea-log61-debuginfo
libkea-database62-debuginfo
libkea-d2srv47-debuginfo
libkea-dhcp_ddns57
libkea-dhcp++92
kea-hooks
libkea-exceptions33

Install updates from vendor's website.

Kea - addressed in versions 2.4.2, 2.6.3, 2.7.9
kea - addressed in versions 2.6.3-1.el9, 2.6.3-1.fc41, 2.6.3-1.fc42
kea (Red Hat package) - update to 2.6.3-1.el10_0
libkea-process74-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dns++57-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcp_ddns57-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cryptolink50-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-devel - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-stats41 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-util-io0-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-hooks100-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-process74 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-stats41-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-tcp19-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-asiolink72-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-d2srv47 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-util86-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cryptolink50 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dns++57 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-asiodns49-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-hooks-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-util86 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-log61 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-eval69 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cfgclient66-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-exceptions33-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcpsrv111 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
python3-kea - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-doc - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-pgsql71 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcp++92-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-asiolink72 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-util-io0 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cc68-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-asiodns49 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcpsrv111-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-http72 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-tcp19 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-http72-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-hooks100 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-pgsql71-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-database62 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cc68 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-eval69-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-mysql71-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-debugsource - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-cfgclient66 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-mysql71 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-log61-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-database62-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-d2srv47-debuginfo - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcp_ddns57 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-dhcp++92 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
kea-hooks - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5
libkea-exceptions33 - addressed in versions 2.6.3-150600.13.6.1, 2.6.3-150700.3.3.5

• https://kb.isc.org/docs/cve-2025-32803

• Multiple vulnerabilities in ISC Kea
• Fedora 42 update for kea
• Fedora 41 update for kea
• Fedora EPEL 9 update for kea
• Red Hat Enterprise Linux 10 update for kea
• SUSE update for kea
• SUSE update for kea