OPENBSD has disclosed a pair of local privilege escalation flaws that together form a chain capable of bypassing kernel protections and attaining root access. The two issues were demonstrated by Calif researchers against OpenBSD 7.9, showing that an attacker could chain a 37-year-old BSD bug with a modern kernel flaw to escape memory protections such as SMAP and SMEP without relying on information disclosure vulnerabilities.
OpenBSD has already released patches for both issues in September; the integer overflow fix was issued as errata 018 on 14 September, and the use-after-free fix as errata 026 on 30 September. Patches are available through syspatch for all architectures.
The exploit chain centres on the kernel’s memory accounting and allocation behaviour. The first flaw leverages a signed 16-bit definition of the shared memory attachment counter, shm_nattch, inherited from early BSD code. By mapping many shared memory segments and forking many processes, an attacker can push the counter beyond its maximum (32,767), causing it to wrap to a negative value and triggering a use-after-free via a race condition.
The second flaw builds on this by performing an out-of-bounds write that overwrites multicast membership counters in the kernel; when a socket closes, the resulting counter updates alter page table entries and permit access to user memory with supervisor privileges. The researchers note there is no evidence of active exploitation in the wild and, at publication, no CVE had been assigned.
Calif’s write-up also suggests mitigations: safer kernel unlinking, boot-time randomisation of page-table mappings, randomising the kernel allocator’s base at boot, and enabling array bounds checks in releases. OpenBSD’s KARL relocation helps reduce predictability, but the researchers emphasise these would further raise the bar for attackers.