OpenBSD 7.9 local root exploit chains old BSD bug with kernel flaw
Original title: Big Fish: OpenBSD Root Exploit Chains a 37-Year-Old BSD Bug With a Kernel Flaw
Calif’s public chain bypasses KARL, SMAP, and SMEP; OpenBSD patched both issues in September via syspatch.
Calif published a full local privilege-escalation exploit and write-up for OpenBSD 7.9 that chains a 1988 signed 16-bit shared-memory counter overflow with a kernel out-of-bounds write. The chain reaches root and bypasses KARL, SMAP, and SMEP without an information leak, using predictable early-boot allocations. OpenBSD fixed the overflow in errata 018 on September 14 and the use-after-free in errata 026 on September 30, both through syspatch on all architectures. Calif says neither flaw is known to be exploited and no CVE is assigned.
Unconfirmed: Calif reports no evidence of in-the-wild exploitation, and no CVE had been assigned at publication.
- shm_nattch was a signed 16-bit integer with a maximum of 32,767.
- The write-up maps 127 shared-memory segments and forks 259 processes to wrap the counter.
- The exploit targets lo0 and enc0 ioctl handlers placed at predictable addresses.
- Calif also reported 21 issues to FreeBSD that similar checks might have caught.
Impact: Local privilege escalation to root
| Product | Affected | Fixed in |
|---|---|---|
| OpenBSD | 7.9 | errata 018 and errata 026 via syspatch |
- 1.Install OpenBSD errata 018 and 026 through syspatch on all architectures.
- Vendors
- OpenBSD
From the original article
3 min read at securityaffairs.comOpenBSD flaws, including a 37-year-old BSD bug, enable local attackers to bypass security protections and gain root access. Patches are available. Cybersecurity firm Calif published a full exploit and write-up this week for a local privilege escalation on OpenBSD 7.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.