Researchers show how two vulnerabilities in OpenBSD 7.9 could grant full administrator privileges

Researchers showcased two vulnerabilities within OpenBSD 7.9 that could enable full administrator privileges. The issue stemmed from the combination of a 37-year-old integer overflow in shmat and a kernel use-after-free. This sequence circumvented KARL and SMAP/SMEP safeguards. OpenBSD patched both faults in September via errata 018 and 026.

No Common Vulnerabilities and Exposures (CVEs) have been assigned and no active exploitation has been noted. The first problem was rooted in a counter, dating back to the early days of BSD in 1988. Once the counter surpassed its limit, it would generate an erroneous value. Coupled with a second flaw in the core operating system, this led to the inadvertent freeing of memory that was still in use by other applications.

By exploiting this duo, researchers were able to manipulate vital data and execute their own code with administrator-level permissions. The necessary fixes were issued in September. California identified the issues and promptly reported them to OpenBSD earlier this year. OpenBSD subsequently released two distinct fixes: one on September 14 addressing the counter issue and another on September 30 tackling the second bug.

The counter fix was categorized as a reliability fix, not a security fix, and was also deployed for OpenBSD 7.8. Both remediations are available for every supported system type through OpenBSD's update tool. As of the publication date, neither vulnerability has been officially cataloged, and there is no evidence of their utilization in actual attacks. G Hacks.gr was designated as a preferred source for cybersecurity updates.