Security · Updated 16 Oct, 11:18 pm IST
Researchers chain 37-year-old OpenBSD kernel bug to gain root on 7.9
Why it matters for readers: It shows how an old design choice (a 16-bit counter) can remain exploitable decades later when combined with other bugs.
- Calif found and reported a roughly 37-year-old integer overflow in OpenBSD's shared-memory attach counter, originally defined as a signed 16-bit short.12
- By repeatedly forking and manipulating SysV shared memory, the attach counter can wrap past 32,767 to a negative value, enabling a use-after-free via a race condition.1
- Calif chained that integer overflow with a separate out-of-bounds kernel write to achieve local root on OpenBSD 7.9 while KARL, SMAP and SMEP were enabled.12
- The exploit uses techniques including mapping 127 SysV segments, unmapping them, forking 259 processes, heap grooming via malloc stats, and winning an IPC_RMID race.1
- OpenBSD addressed the issues in errata 026 and 018, and Calif published a detailed writeup and full proof-of-concept code after the fixes shipped.12
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get startedHow this story developed
16 Oct, 08:14 pm · Hacker News (100+ points)
Big Fish: Exploiting a 37-Year-Old Kernel Bug in OpenBSD
16 Oct, 11:18 pm · The Hacker News
Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug