Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped
Researchers showcase an exploit for OpenBSD 7.9 that gains root access by combining a 37-year-old integer overflow vulnerability with a separate kernel flaw. This chain of attacks circumvents OpenBSD's KARL kernel-address randomization and SMAP/SMEP hardware protections. Security firm Calif discovered and reported these flaws, later incorporated the fixes into OpenBSD patches released in September.
The exploit begins with an integer overflow in the shmat(4) attach function, which was patched in errata 018 on September 14. Following that, a reference-counting use-after-free bug, fixed in errata 026 on September 30, completes the chain. Both patches are available through syspatch and cover all architectures. The exploit relies on a shared-memory attachment counter (shm_nattch), originally a 16-bit short with a maximum value of 32,767, inherited from original BSD.
By mapping 127 shared-memory segments and forking 259 processes, the counter wraps around to −32,643, causing a race condition that triggers a use-after-free. This leads to an out-of-bounds write that overwrites kernel multicast-membership counters. When the affected socket closes, decrements modify page-table entries, switching a user-memory mapping to supervisor-accessible, thereby bypassing SMAP and SMEP.
The exploit overwrites a predictable kernel function pointer to execute its own malicious code. OpenBSD 7.8 received the integer overflow fix, but no CVE has been assigned to either flaw as of publication. There is no evidence of these vulnerabilities being exploited in attacks. Calif suggests four categories of hardening, including safe-unlinking for kernel linked lists, randomization of page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking.
They reported the vulnerabilities to OpenBSD earlier this year, and the proof-of-concept exploit code is available on GitHub.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
