OpenBSD Root Exploit Chains 37-Year-Old Bug
Researchers bypass kernel protections by chaining an integer overflow with a memory flaw.
1Exploit Chain Mechanics
Security firm Calif demonstrated a local privilege escalation on OpenBSD 7.9 by chaining two distinct kernel flaws. The exploit targets a 37-year-old integer overflow in the shmat function alongside a reference-counting use-after-free vulnerability. These combined flaws allow attackers to gain root access by bypassing critical kernel-address randomization and hardware-based protections.
2Legacy Code Vulnerability
The primary entry point is a signed 16-bit short integer, shm_nattch, dating back to 1988 BSD sources. OpenBSD never widened this counter, which caps at 32,767. By mapping 127 shared-memory segments and forking 259 processes, researchers triggered an integer wrap-around, forcing the counter to negative values and corrupting kernel memory management.
3Bypassing Kernel Protections
The exploit successfully bypasses KARL, SMAP, and SMEP protections. By triggering a use-after-free, the kernel incorrectly frees memory still in use. A subsequent out-of-bounds write modifies page-table entries, enabling supervisor-level access. This allows the exploit to overwrite function pointers at predictable addresses, ultimately executing arbitrary code within the kernel's privileged environment.
4Deterministic Memory Allocation
Researcher Andrew Griffiths noted that while OpenBSD's KARL randomizes binary addresses, the kernel's memory allocators remain deterministic. Both boot-time and best-fit allocators lack base-address randomization. Consequently, critical structures like network-interface handlers consistently land at identical addresses across reboots, allowing the exploit to function without needing an initial information-disclosure vulnerability.
5Patching and Errata
OpenBSD addressed these vulnerabilities in September 2024 through two separate errata. The integer overflow was patched on September 14 as a reliability fix, while the use-after-free was resolved on September 30 as a security fix. Both patches are available via syspatch for all architectures, including support for OpenBSD 7.8 systems.
6Absence of CVE Tracking
Despite the severity of the privilege escalation, no CVE identifiers have been assigned to these flaws as of the publication date. There is currently no evidence suggesting these vulnerabilities have been exploited in the wild. Calif reported the findings to the OpenBSD team earlier this year, leading to the coordinated release of patches.
7Proposed Kernel Hardening
Calif researchers proposed four specific hardening measures to prevent similar future exploits. These include implementing safe-unlinking for kernel linked lists, similar to FreeBSD and NetBSD, alongside randomization of page-table self-referential mappings. They also recommend kernel-allocator randomization and compiler-based bounds checking to mitigate risks associated with legacy code and deterministic memory allocation patterns.
8Security Implications
This exploit highlights the risks inherent in maintaining legacy codebases within modern operating systems. By chaining minor reliability issues, researchers demonstrated that even hardened kernels remain susceptible to complex privilege escalation attacks. Security teams must prioritize applying these specific errata to ensure that kernel-level protections remain effective against sophisticated memory-based exploitation techniques.
Original article: The Hacker News — OpenBSD Root Exploit Chains 37-Year-Old Bug