RESEARCHERS have demonstrated a local privilege escalation against OpenBSD 7.9 by chaining a long-standing shared‑memory bug with a separate kernel flaw, allowing an attacker to gain root access. The exploit combines an integer overflow in the shmat(4) attach function with a use‑after‑free triggered by a reference‑count race, then an out‑of‑bounds write that overwrites kernel memory and a function pointer to execute code.
The chain bypasses OpenBSD’s KARL kernel address randomisation and hardware protections such as SMAP and SMEP, enabling an attacker to run arbitrary code with kernel privileges.
Calif, the security firm behind the disclosure, disclosed two fixes released by OpenBSD in September: errata 018 for the 37‑year‑old integer overflow in shmat, shipped 14 September as a reliability fix, and errata 026 for the reference‑counting use‑after‑free, shipped 30 September as a security fix. Patches are available via syspatch for all architectures, and OpenBSD 7.8 also received the integrity repair.
Notably, no CVE has been assigned to either flaw as of publication, and there is no available evidence that the vulnerabilities have been exploited in the wild. The researchers’ write‑up also notes that the memory allocators in early boot stages remain deterministic, which aids the exploit’s success across reboots on the same hardware. Calif proposes hardening measures including safe unlinking for kernel lists, page‑table randomisation, kernel allocator randomisation, and compiler‑based bounds checking. The full proof‑of‑concept code is published alongside the write‑up.