Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
Calif details a patched OpenBSD local-root bug tracing to a 37-year-old shared-memory counter.
Calif reported OpenBSD kernel bugs, including a signed 16-bit shared-memory attachment counter inherited from early BSD roughly 37 years ago. Overflowing that counter could cause a use-after-free, and together with a separate out-of-bounds kernel write it allowed local privilege escalation to root even with KARL, SMAP, and SMEP enabled. OpenBSD addressed the issues in errata 026 and 018. The write-up also argues that predictable kernel allocations weakened randomization and suggests safe-unlinking and allocator randomization. No CVE IDs or in-the-wild exploitation were stated.
- A 16-bit shared-memory counter could wrap and enable a use-after-free
- Combined with an out-of-bounds write, local root was possible
- OpenBSD fixed the issues in errata 026 and 018
- Suggested defenses include safe-unlinking and allocator randomization
- Products
- OpenBSD
From the original article
5 min read at calif.io
Calif frequently publishes our offensive research and work, but we otherwise don't draw much attention to the defensive work we do — assisting open source projects with remediation, patch generation, cryptographic improvements, and internal engineering projects we carry out for our clients. Earlier this year, we reported some vulnerabilities, often along with suggested patches to OpenBSD.
By rs_rs_rs_rs_rs · calif.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.