Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD

In the early 1980s, a kernel bug was discovered in OpenBSD, traced back to a shared memory attachment counter defined as a signed 16-bit short. Repeatedly forking processes with shared memory attachment could cause the counter to overflow, leading to a use-after-free via a race condition. This, combined with a separate out-of-bounds write in the kernel, allowed local privilege escalation to root.

The vulnerability was patched in errata 026 and 018, but Calif, an offensive research firm, noted that OpenBSD's KARL relinking randomizes both function and data addresses, while kernel memory allocators remain deterministic. This made predictable kernel pointer locations ideal targets for exploitation.

To address the issue, Calif proposed several defensive improvements. Firstly, safe-unlinking can be implemented to check doubly linked list invariants before performing unlink memory writes. If invariants are violated, an abort() or panic() is called, preventing memory corruption. FreeBSD and NetBSD have an implementation of safe-unlinking in their sys/queue.h.

Secondly, the self-referential PTE map allocation address can be randomized using a random byte and selecting a PML4 slot at boot time. This makes targeted atomic decrement locations impossible. Thirdly, the kernel allocator can be made non-deterministic by randomizing the base address where memory allocations occur at boot time and the allocation order at run time.

Compiler features like the array bounds sanitizer and upcoming Alloc Tokens can also help mitigate against entire vulnerabilities. The array bounds sanitizer can eliminate out-of-bounds fixed size array accesses, while Alloc Tokens can isolate pointer-containing allocations from non-pointer allocations, making overflows more difficult to exploit.

OpenBSD has consistently championed proactive security, setting the standard for system and network hardening. By investing in defensive improvements, the bar for attackers is raised, ensuring robust protection and long-term resilience.