Security firm Calif has published a detailed write-up and full proof-of-concept code for a local privilege escalation on OpenBSD 7.9. The exploit chains two kernel flaws to turn an ordinary unprivileged account into root, and it gets past OpenBSD’s KARL kernel-address randomization as well as the SMAP and SMEP hardware protections. Both bugs were fixed in September, and there is no evidence either has been used in attacks. No CVE has been assigned for either flaw as of publication, according to The Hacker News.
The entry point is an integer overflow in the shmat(4) shared-memory attach function. The attach counter, shm_nattch, is a signed 16-bit value that dates to original BSD sources from 1988, and OpenBSD never widened it. The exploit maps 127 shared-memory segments and forks 259 processes to push the counter past 32,767 so it wraps negative, then races to trigger a use-after-free. A second out-of-bounds write to multicast-membership counters is used to alter page-table entries, which flips a user-memory mapping to supervisor-accessible. OpenBSD’s allocators lack base-address randomization, so early-boot structures such as function pointers in the lo0 and enc0 handlers land at the same addresses across reboots on the same hardware, and the exploit needs no separate information leak. The exploit is a local one: an attacker needs to already be able to run code on the machine.
One detail worth noting for patch tracking: the overflow fix shipped as a reliability fix, not a security fix, so it is easy to overlook when skimming the errata list for security entries. Calif also proposes hardening such as safe-unlinking for kernel linked lists, randomizing the page-table self-referential mapping, and randomizing kernel allocators.
How to check if you’re affected
Affected versions are OpenBSD 7.9 and 7.8 installs that have not applied the September errata. On 7.9, the OpenBSD errata page lists errata 018 (shmat(4) integer overflow, a reliability fix dated September 14) and errata 026 (kernel reference-counting use-after-free, a security fix dated September 30), both for all architectures. The Hacker News reports that 7.8 also received the integer-overflow fix; check the errata page for your release for the matching entries.
- Run
syspatchand reboot if it installs a kernel update. - Run
syspatch -lto list installed patches and confirm both fixes appear for your release. - Treat multi-user systems and any host that runs untrusted local code as the priority, since the exploit needs local code execution.