Public exploit gains root on OpenBSD 7.9 by chaining a decades-old shared-memory bug

Security firm Calif has published a working exploit that gives a local user root privileges on OpenBSD 7.9 by chaining a shared-memory bug rooted in code from 1988 with newer kernel flaws, The Hacker News reported on Oct. 16. The release, accompanied by a detailed write-up titled "big-fish" and full proof-of-concept code on GitHub, is notable because OpenBSD is widely deployed in firewalls and security-sensitive systems where it is valued for its hardening. OpenBSD shipped fixes for the issues in September.

What happened

According to The Hacker News, Calif reported the flaws to the OpenBSD project earlier this year. Patches were released in September, and the write-up and exploit followed on Oct. 16. The publication said no CVE had been assigned to either flaw at the time of publication and that there is no evidence of exploitation in attacks.

Technical details

The chain starts with an integer overflow in the shared-memory attach function shmat. The Hacker News reported that the attachment counter shm_nattch is a signed 16-bit value with a maximum of 32,767, a type inherited from 1988 BSD sources and never widened. By mapping 127 shared-memory segments and forking 259 processes, the exploit forces the counter to wrap to a negative value.

The corrupted counter then triggers a race condition that leads to a reference-counting use-after-free, causing the kernel to free memory still in use. A separate out-of-bounds write overwrites kernel multicast-membership counters; when the affected socket closes, the decrements alter page-table entries so that a user memory mapping becomes accessible to the kernel, bypassing the SMAP and SMEP protections. The exploit then overwrites a function pointer at a predictable kernel address.

The Hacker News said the chain also defeats KARL, OpenBSD's kernel address randomization, because the kernel's memory allocators remain deterministic, leaving some network-interface handler pointers at the same addresses across reboots on the same hardware. No information-disclosure bug is needed.

Who is affected

The exploit was demonstrated against OpenBSD 7.9. According to the report, OpenBSD 7.8 also received the integer overflow fix. Because the attack is local, systems that allow untrusted users or run exposed services that could give an attacker a foothold face the greatest risk.

What to do

Administrators should apply both errata through syspatch: errata 018, released Sept. 14 and classified by OpenBSD as a reliability fix, and errata 026, released Sept. 30 as a security fix. Both are needed to fully close the chain, and they cover all architectures. Calif also proposed further hardening, including safe-unlinking for kernel linked lists, randomizing the page-table self-referential mapping, kernel allocator randomization and compiler-based bounds checking.