/
← Voltar ao feed
high

Public PoC chains 37-year-old OpenBSD shmat integer overflow with kernel UAF for root on OpenBSD 7.9, bypassing KARL, SMAP and SMEP

1 fonte(s) · 1 atualização(ões) · publicado 16/10/2026 14:48 · coletado há 2 dias

Security firm Calif published a full writeup and proof-of-concept code for a local privilege escalation exploit that gains root on OpenBSD 7.9. It chains a roughly 37-year-old integer overflow in the shared-memory attach path with a separate kernel flaw, and it bypasses KARL, SMAP and SMEP. OpenBSD patched both issues in September (errata 018 and 026), and the PoC is on GitHub. No CVE has been assigned, and there is no evidence of exploitation in attacks.

Detalhes técnicos

  • The shared-memory attachment counter shm_nattch is a signed 16-bit short (max 32,767), a type inherited from 1988 BSD sources. The exploit maps 127 shared-memory segments and forks 259 processes, wrapping the counter to −32,643.
  • A race condition then triggers a reference-counting use-after-free, so the kernel frees memory that other processes still use.
  • A separate out-of-bounds write overwrites multicast-membership counters. When the socket closes, the resulting decrements modify page-table entries, making a user-memory mapping supervisor-accessible and bypassing SMAP and SMEP.
  • The exploit overwrites a function pointer at a predictable kernel address to run its own code. KARL does not stop this, because the boot-time and best-fit kernel allocators are deterministic and lack base-address randomization. Early-boot structures such as the lo0 and enc0 interface handlers land at the same addresses across reboots on the same hardware, so no information-disclosure bug is needed.
  • The integer overflow, the entry point of the chain, was shipped as a reliability fix, not a security fix.
  • Calif proposes four hardening measures: safe-unlinking for kernel linked lists, randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking.

Remediação

  • Apply errata 018 (shipped September 14, integer overflow, also available for OpenBSD 7.8) and errata 026 (shipped September 30, use-after-free) via syspatch. Both cover all architectures.
  • Prioritize multi-user systems, where local code execution is plausible, because the public PoC lowers the barrier to exploitation.

Linha do tempo

  1. thehackernews.com ↗ · pub. 16/10/2026 14:48 · coletado 19/10 17:53 primeiro registro

    Public PoC chains 37-year-old OpenBSD shmat integer overflow with kernel UAF for root on OpenBSD 7.9, bypassing KARL, SMAP and SMEP

    ler a análise desta fonte

    Security firm Calif published a full writeup and proof-of-concept code for a local privilege escalation exploit that gains root on OpenBSD 7.9. It chains a roughly 37-year-old integer overflow in the shared-memory attach path with a separate kernel flaw, and it bypasses KARL, SMAP and SMEP. OpenBSD patched both issues in September (errata 018 and 026), and the PoC is on GitHub. No CVE has been assigned, and there is no evidence of exploitation in attacks.

    Technical Details

    • The shared-memory attachment counter shm_nattch is a signed 16-bit short (max 32,767), a type inherited from 1988 BSD sources. The exploit maps 127 shared-memory segments and forks 259 processes, wrapping the counter to −32,643.
    • A race condition then triggers a reference-counting use-after-free, so the kernel frees memory that other processes still use.
    • A separate out-of-bounds write overwrites multicast-membership counters. When the socket closes, the resulting decrements modify page-table entries, making a user-memory mapping supervisor-accessible and bypassing SMAP and SMEP.
    • The exploit overwrites a function pointer at a predictable kernel address to run its own code. KARL does not stop this, because the boot-time and best-fit kernel allocators are deterministic and lack base-address randomization. Early-boot structures such as the lo0 and enc0 interface handlers land at the same addresses across reboots on the same hardware, so no information-disclosure bug is needed.
    • The integer overflow, the entry point of the chain, was shipped as a reliability fix, not a security fix.
    • Calif proposes four hardening measures: safe-unlinking for kernel linked lists, randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking.

    Remediation

    • Apply errata 018 (shipped September 14, integer overflow, also available for OpenBSD 7.8) and errata 026 (shipped September 30, use-after-free) via syspatch. Both cover all architectures.
    • Prioritize multi-user systems, where local code execution is plausible, because the public PoC lowers the barrier to exploitation.