OpenBSD Root Exploit Chains 37-Year-Old Shared-Memory Bug

A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped patches for both issues in September. The integer overflow in the shmat(4) attach function was fixed in errata 018, shipped September 14 as a reliability fix. The reference-counting use-after-free that completes the chain was fixed separately in errata 026, shipped September 30 as a security fix. Both are available through syspatch and cover all architectures. OpenBSD 7.8 also received the integer-overflow fix. The shared-memory attachment counter shm_nattch is defined as a signed 16-bit short with a maximum value of 32,767 in original BSD sources dating to 1988. The exploit maps 127 shared-memory segments and forks 259 processes, pushing the counter past its maximum and wrapping it to −32,643. A race condition then triggers a use-after-free, and a separate out-of-bounds write overwrites multicast-membership counters to modify page-table entries, bypassing SMAP and SMEP. Calif proposes four categories of hardening: safe-unlinking for kernel linked lists, randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking. No CVE has been assigned for either flaw as of publication, and there is no evidence that the vulnerabilities have been used in attacks.