A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped patches for both issues in September.

The integer overflow in the shmat(4) attach function was fixed in errata 018, shipped September 14 as a reliability fix. The reference-counting use-after-free that completes the chain was fixed separately in errata 026, shipped September 30 as a security fix.

Both are available through syspatch and cover all architectures. OpenBSD 7.8 also received the integer-overflow fix.

The integer overflow, the entry point for the full chain, is classified as a reliability fix, not a security fix.

No CVE has been assigned for either flaw as of publication. There is no evidence that the vulnerabilities have been used in attacks.

The shared-memory attachment counter shm_nattch is defined as a signed 16-bit short with a maximum value of 32,767 in original BSD sources dating to 1988. OpenBSD inherited the type and never widened it.

The exploit maps 127 shared-memory segments and forks 259 processes, pushing the counter past its maximum and wrapping it to −32,643. A race condition then triggers a use-after-free: the corrupted reference count causes the kernel to free memory that other processes still use.

A separate out-of-bounds write overwrites multicast-membership counters in the kernel. When the affected socket closes, the resulting decrements modify page-table entries, switching a user-memory mapping to supervisor-accessible and bypassing SMAP and SMEP.

Source link