Public PoC chains 37-year-old OpenBSD shmat integer overflow with kernel UAF for root on OpenBSD 7.9, bypassing KARL, SMAP and SMEP
Security firm Calif published a full writeup and proof-of-concept code for a local privilege escalation exploit that gains root on OpenBSD 7.9. It chains a roughly 37-year-old integer overflow in the shared-memory attach path with a separate kernel flaw, and it bypasses KARL, SMAP and SMEP. OpenBSD patched both issues in September (errata…