● Covered by 2 sources · 2 reportsMedium impact2 neutral
OpenBSD Local Privilege Escalation Exploit Uses 37-Year-Old Kernel Bug
Key points
- A 37-year-old integer overflow in OpenBSD's shared memory attachment counter was exploited.
- The vulnerability, combined with an out-of-bounds write, allowed local privilege escalation to root.
- The exploit bypasses OpenBSD's KARL, SMAP, and SMEP protections.
- Patches were released in September 2023 as errata 018 and 026.
- No CVE has been assigned, and no evidence of in-the-wild exploitation exists.
Exploit Details
Security firm Calif discovered and exploited a local privilege escalation vulnerability in OpenBSD 7.9. The exploit chains two distinct flaws to gain root access. The primary entry point is an integer overflow in the shared memory attachment counter, which has been present in the BSD sources for approximately 37 years. This counter, defined as a signed 16-bit short, can be forced to wrap to a negative value after exceeding its maximum of 32,767 by repeatedly forking processes with shared memory attachments.
This integer overflow creates a use-after-free condition via a race condition. When combined with a separate out-of-bounds write vulnerability in the kernel, it allows for local privilege escalation to root. The exploit successfully bypasses OpenBSD's Kernel Address Randomization (KARL) and hardware protections like SMAP and SMEP.
Historical Context and Patches
The integer overflow vulnerability traces back to the original BSD sources, where the shared-memory attachment counter (shm_nattch) was defined as a signed 16-bit short. Calif reported these vulnerabilities to OpenBSD, providing suggested patches.
OpenBSD released fixes for these issues in September 2023. The integer overflow in the shmat(4) attach function was addressed in errata 018 on September 14, classified as a reliability fix. The reference-counting use-after-free, which completes the exploit chain, was fixed separately in errata 026 on September 30, classified as a security fix. Both patches are available via syspatch and cover all architectures, with OpenBSD 7.8 also receiving the integer-overflow fix.
Impact and Classification
As of the publication of the exploit details, no CVE has been assigned for either flaw. There is no evidence to suggest that these vulnerabilities have been exploited in real-world attacks. The integer overflow, while critical to the exploit chain, was initially classified as a reliability fix rather than a security fix by OpenBSD.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub weiss/original-bsd GitHub openbsd/src GitHub califio/publications GitHub CalANDif/openbsd-src GitHub freebsd/freebsd-src GitHub NetBSD/srcHow outlets covered it
Security researchers demonstrated a local privilege escalation exploit for OpenBSD 7.9, achieving root access by combining a 37-year-old integer overflow with a separate kernel flaw. The exploit bypasses OpenBSD's KARL, SMAP, and SMEP protections, highlighting the persistence of legacy vulnerabilities and the need for robust kernel hardening.
A 37-year-old integer overflow vulnerability in OpenBSD's shared memory attachment counter, combined with an out-of-bounds write, allowed local privilege escalation to root. The flaw, present since the original BSD sources, was exploited to achieve kernel code execution and obtain a root shell.