37-Year-Old Kernel Flaw Exploited to Gain Root Access on OpenBSD — PoC Released
Researchers released a patched OpenBSD local root exploit chaining a 37-year-old shared-memory bug.
Calif researchers published a local proof-of-concept that gains root on OpenBSD by chaining two kernel flaws, after OpenBSD patched both. A System V shared-memory counter, shm_nattch, is a signed 16-bit value dating to early BSD; repeated forks wrap it past 32,767, causing a race and kernel use-after-free. A second conditional out-of-bounds write corrupts page-table state so the exploit runs kernel code and opens a root shell despite KARL, SMAP, and SMEP, without a separate information leak. Fixes are in Errata 018 and 026, with syspatch binaries for amd64, i386, and arm64; the write-up does not report real-world attacks.
- shm_nattch is a signed 16-bit counter that wraps past 32,767.
- Overflow and a race produce a kernel use-after-free.
- An out-of-bounds write enables kernel code execution and root.
- PoC works with KARL, SMAP, and SMEP and no info leak.
- OpenBSD patched both bugs in Errata 018 and 026 before publication.
From the original article
3 min read at cybersecuritynews.com
A proof-of-concept exploit that gains root access on OpenBSD by chaining two kernel flaws. The main bug dates back about 37 years to the original BSD source code. According to Security researchers at Calif, the flaw survived because a shared memory attachment counter named shm_nattch used a signed 16-bit value.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.