- Security firm Calif published a local privilege escalation exploit that achieves root access on OpenBSD 7.9 by chaining a 37-year-old integer overflow with a kernel use-after-free flaw.
- The exploit bypasses OpenBSD’s KARL kernel-address randomization and hardware protections including SMAP and SMEP.
- OpenBSD shipped patches for both vulnerabilities in September, available through
syspatchfor all architectures. - No CVE numbers were assigned, and there is no evidence the flaws were exploited in attacks.
Security firm Calif published a local privilege escalation exploit today that gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw. The exploit bypasses OpenBSD’s KARL kernel-address randomization and its SMAP and SMEP hardware protections, according to a detailed writeup.
The integer overflow in the shmat(4) attach function was fixed in errata 018, shipped September 14 as a reliability fix. The reference-counting use-after-free was fixed separately in errata 026, shipped September 30 as a security fix.
Both patches are available through syspatch and cover all architectures. The shared-memory attachment counter shm_nattch is defined as a signed 16-bit short in original BSD sources dating to 1988.
The exploit maps 127 shared-memory segments and forks 259 processes, pushing the counter past its maximum. A race condition then triggers a use-after-free, causing the kernel to free memory still in use by other processes.
Meanwhile, a separate out-of-bounds write overwrites multicast-membership counters in the kernel. When the affected socket closes, resulting decrements modify page-table entries, bypassing SMAP and SMEP.
Researcher Andrew Griffiths stated: “While OpenBSD’s KARL relinks the kernel binary to randomize both function and data addresses, the kernel’s memory allocators remain deterministic.” The exploit needs no information-disclosure vulnerability.
Calif proposes four categories of hardening beyond the two errata: safe-unlinking for kernel linked lists, randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking. The proof-of-concept exploit code is available on GitHub.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
