Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
Researchers published a local OpenBSD 7.9 root exploit chaining a 1988 shared-memory bug with a kernel use-after-free.
Security firm Calif published a local privilege-escalation proof of concept that gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow in the shmat shared-memory attach counter with a kernel reference-counting use-after-free. The chain bypasses KARL plus SMAP and SMEP because kernel allocators remain deterministic, and it needs no separate information leak. OpenBSD fixed the overflow in errata 018 on September 14 and the use-after-free in errata 026 on September 30; OpenBSD 7.8 also received the overflow fix. No CVE was assigned, and Calif reported no evidence of real-world attacks.
- Calif chained a 1988 shmat integer overflow with a kernel use-after-free for local root.
- The chain bypasses OpenBSD KARL, SMAP, and SMEP without an information leak.
- Patches shipped in September errata 018 and 026; no CVE was assigned.
- There is no evidence of in-the-wild use; a proof of concept was published.
From the original article
6 min read at thehackernews.com
A local privilege escalation exploit published today gains root on OpenBSD 7. 9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.