# OpenBSD Root Exploit Chains 37-Year-Old Bug Researchers bypass kernel protections by chaining an integer overflow with a memory flaw. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-16 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/02071617-26c7-4a46-829b-8e47d9bbecd2 ## Exploit Chain Mechanics Security firm Calif demonstrated a local privilege escalation on OpenBSD 7.9 by chaining two distinct kernel flaws. The exploit targets a 37-year-old integer overflow in the shmat function alongside a reference-counting use-after-free vulnerability. These combined flaws allow attackers to gain root access by bypassing critical kernel-address randomization and hardware-based protections. ## Legacy Code Vulnerability The primary entry point is a signed 16-bit short integer, shm_nattch, dating back to 1988 BSD sources. OpenBSD never widened this counter, which caps at 32,767. By mapping 127 shared-memory segments and forking 259 processes, researchers triggered an integer wrap-around, forcing the counter to negative values and corrupting kernel memory management. ## Bypassing Kernel Protections The exploit successfully bypasses KARL, SMAP, and SMEP protections. By triggering a use-after-free, the kernel incorrectly frees memory still in use. A subsequent out-of-bounds write modifies page-table entries, enabling supervisor-level access. This allows the exploit to overwrite function pointers at predictable addresses, ultimately executing arbitrary code within the kernel's privileged environment. ## Deterministic Memory Allocation Researcher Andrew Griffiths noted that while OpenBSD's KARL randomizes binary addresses, the kernel's memory allocators remain deterministic. Both boot-time and best-fit allocators lack base-address randomization. Consequently, critical structures like network-interface handlers consistently land at identical addresses across reboots, allowing the exploit to function without needing an initial information-disclosure vulnerability. ## Patching and Errata OpenBSD addressed these vulnerabilities in September 2024 through two separate errata. The integer overflow was patched on September 14 as a reliability fix, while the use-after-free was resolved on September 30 as a security fix. Both patches are available via syspatch for all architectures, including support for OpenBSD 7.8 systems. ## Absence of CVE Tracking Despite the severity of the privilege escalation, no CVE identifiers have been assigned to these flaws as of the publication date. There is currently no evidence suggesting these vulnerabilities have been exploited in the wild. Calif reported the findings to the OpenBSD team earlier this year, leading to the coordinated release of patches. ## Proposed Kernel Hardening Calif researchers proposed four specific hardening measures to prevent similar future exploits. These include implementing safe-unlinking for kernel linked lists, similar to FreeBSD and NetBSD, alongside randomization of page-table self-referential mappings. They also recommend kernel-allocator randomization and compiler-based bounds checking to mitigate risks associated with legacy code and deterministic memory allocation patterns. ## Security Implications This exploit highlights the risks inherent in maintaining legacy codebases within modern operating systems. By chaining minor reliability issues, researchers demonstrated that even hardened kernels remain susceptible to complex privilege escalation attacks. Security teams must prioritize applying these specific errata to ensure that kernel-level protections remain effective against sophisticated memory-based exploitation techniques. ## Sources covering this story - https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._