/
← Voltar ao feed
medium

Calif publishes OpenBSD 7.9 root exploit chaining 37-year-old shm_nattch overflow with kernel out-of-bounds write; patched

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 07:34 · coletado há 2 dias

Cybersecurity firm Calif published a full exploit and write-up for a local privilege escalation to root on OpenBSD 7.9, chaining two kernel flaws, one of which is a 37-year-old integer overflow inherited from the original BSD sources. The exploit bypasses KARL address randomization and SMAP/SMEP protections without requiring any information disclosure bug. OpenBSD patched both issues in September (errata 018 on September 14 and errata 026 on September 30). Calif reports no evidence of exploitation in the wild, and no CVE has been assigned to either flaw.

Detalhes técnicos

  • The shared memory attachment counter shm_nattch has been a signed 16-bit integer (max 32,767) since 1988. Mapping 127 shared memory segments and forking 259 processes wraps the counter negative, triggering a use-after-free via a race condition (won using IPC_RMID while a helper process attaches a size-confused segment).
  • A second flaw, an out-of-bounds write, overwrites multicast membership counters in the kernel. When the socket closes, the counter updates modify page table entries, giving user memory supervisor-level access and bypassing SMAP/SMEP via kernel memory accounting errors.
  • KARL randomizes the kernel binary, but the boot-time and best-fit allocators lack base address randomization, so early boot allocations land at predictable addresses across reboots on the same hardware. The exploit overwrites function pointers in the lo0 and enc0 interface ioctl handlers to gain code execution and restore the pointer afterward.
  • Researchers used sysctl kernel allocation metrics to perform heap layout analysis from userland, and aligned IP socket allocations with a non-default multicast TTL to place a persistent 16-byte structure.
  • Calif proposes hardening: safe-unlinking for kernel linked lists (already in FreeBSD and NetBSD), randomizing the page table self-referential mapping, randomizing the kernel allocator base address, and enabling array bounds checks in release builds. Calif also reported 21 issues to FreeBSD that bounds checks could have caught.

Remediação

  • Apply errata 018 and errata 026 via syspatch; patches cover all architectures.

Linha do tempo

  1. securityaffairs.com ↗ · pub. 19/10/2026 07:34 · coletado 19/10 17:54 primeiro registro

    Calif publishes OpenBSD 7.9 root exploit chaining 37-year-old shm_nattch overflow with kernel out-of-bounds write; patched

    ler a análise desta fonte

    Cybersecurity firm Calif published a full exploit and write-up for a local privilege escalation to root on OpenBSD 7.9, chaining two kernel flaws, one of which is a 37-year-old integer overflow inherited from the original BSD sources. The exploit bypasses KARL address randomization and SMAP/SMEP protections without requiring any information disclosure bug. OpenBSD patched both issues in September (errata 018 on September 14 and errata 026 on September 30). Calif reports no evidence of exploitation in the wild, and no CVE has been assigned to either flaw.

    Technical Details

    • The shared memory attachment counter shm_nattch has been a signed 16-bit integer (max 32,767) since 1988. Mapping 127 shared memory segments and forking 259 processes wraps the counter negative, triggering a use-after-free via a race condition (won using IPC_RMID while a helper process attaches a size-confused segment).
    • A second flaw, an out-of-bounds write, overwrites multicast membership counters in the kernel. When the socket closes, the counter updates modify page table entries, giving user memory supervisor-level access and bypassing SMAP/SMEP via kernel memory accounting errors.
    • KARL randomizes the kernel binary, but the boot-time and best-fit allocators lack base address randomization, so early boot allocations land at predictable addresses across reboots on the same hardware. The exploit overwrites function pointers in the lo0 and enc0 interface ioctl handlers to gain code execution and restore the pointer afterward.
    • Researchers used sysctl kernel allocation metrics to perform heap layout analysis from userland, and aligned IP socket allocations with a non-default multicast TTL to place a persistent 16-byte structure.
    • Calif proposes hardening: safe-unlinking for kernel linked lists (already in FreeBSD and NetBSD), randomizing the page table self-referential mapping, randomizing the kernel allocator base address, and enabling array bounds checks in release builds. Calif also reported 21 issues to FreeBSD that bounds checks could have caught.

    Remediation

    • Apply errata 018 and errata 026 via syspatch; patches cover all architectures.