| Description |
Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths.
If an attacker has access to a local unprivileged user account, and the Kea API entry points are not secured, the attacker can use the API to arbitrarily modify Kea's configuration or to overwrite any file Kea has write access to. If Kea is running as root, the attacker could overwrite any local file. This can lead to local privilege escalation and/or system-wide denial of service. If control sockets are placed in an insecure location, any local user may be able to impersonate a Kea service or prevent the real Kea service from starting. |