Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD

OpenBSD has long been recognized for its strong security posture, leveraging proactive measures such as source code auditing, insecure API replacement, advanced password hashing, cryptography, privilege separation, sandboxing, and memory safety mechanisms like ASLR and W^X. The latest vulnerabilities, discovered in the shared memory attachment counter handling, demonstrate the importance of continually refining these defenses.

In this case, a 37-year-old kernel bug was exploited to achieve local privilege escalation to root without the need for an information disclosure vulnerability. The issue stemmed from an integer overflow caused by repeatedly forking processes with shared memory attachments, leading to a race condition and subsequent use-after-free.

The kernel's deterministic memory allocation patterns at boot time, particularly the predictable locations of certain structures, provided a prime target for exploitation. However, the team behind this research proposes several defensive strategies to mitigate such vulnerabilities. These include implementing safe-unlinking, a technique that verifies doubly linked list invariants before unlinking, and randomizing the self-referential PTE map allocation address.

Other options involve making the kernel allocator non-deterministic by randomizing both the base address for memory allocations and the allocation order at runtime. Additionally, leveraging compiler features such as the array bounds sanitizer and Alloc Tokens can further enhance protection against similar exploits. By adopting these defensive improvements, OpenBSD and other systems can significantly raise the bar for attackers, reducing the likelihood of successful exploitation and ensuring long-term system resilience.