Ethical Hacking News
A recent vulnerability in OpenBSD has exposed a 37-year-old bug in the kernel that can be exploited to bypass security protections and gain root access. Researchers have found that many users have not applied the patches for this vulnerability, which poses a significant security risk. The researchers have suggested four security improvements that could make this attack much harder or prevent it entirely. This article provides a detailed explanation of the vulnerability, its impact, and the proposed solutions to address it.
A 37-year-old bug in the OpenBSD kernel can be exploited to bypass security protections and gain root access. A race condition triggered by an integer overflow causes a use-after-free vulnerability. Another out-of-bounds write overwrites multicast membership counters, allowing a local attacker to bypass SMAP and SMEP protections. Patches were shipped by OpenBSD in September, but many users have not applied them, posing a security risk. Suggested security improvements include safe-unlinking, randomizing page table mappings, and enabling array bounds checks. Additional vulnerabilities were reported to FreeBSD that could be caught by the same protection.
In a recent discovery, researchers at Calif have exposed a 37-year-old bug in the OpenBSD kernel that can be exploited to bypass security protections and gain root access. This bug was inherited from the original BSD sources and has been present in the OpenBSD 7.9 kernel for quite some time. The vulnerability is triggered by an integer overflow in the shared memory attachment counter, which, when pushed beyond its limit, causes a race condition that leads to a use-after-free vulnerability.
The second flaw is an out-of-bounds write that overwrites multicast membership counters in the kernel, allowing a local attacker to bypass SMAP and SMEP protections. This vulnerability exploits errors in the kernel’s internal memory accounting, rather than directly attacking the hardware.
OpenBSD has shipped patches for both issues in September, namely the integer overflow fix in errata 018 and the related use-after-free fix in errata 026, which are available through the syspatch command and cover all architectures. However, the researchers at Calif have found that these patches have not been applied by many users, which poses a significant security risk.
The researchers used kernel memory allocation metrics available through sysctl to track live allocations and detect when new pages were being created, essentially doing heap layout analysis from userland. They aligned IP socket allocations and set a multicast TTL option to a non-default value to get a persistent 16-byte structure placed where they needed it.
The researchers suggest four security improvements that could make this attack much harder or prevent it entirely. First, safe-unlinking for kernel linked lists checks that data structures are valid before writing to memory. If something is wrong, the kernel stops.
Second, randomizing the page table’s self-referential mapping at boot would prevent attackers from predicting which memory location to target with the decrement operation.
Third, randomizing the kernel allocator’s base address at boot would make it harder to predict function pointer locations. The researchers say this protection would have almost no performance cost.
Finally, enabling array bounds checks in release builds would detect this type of out-of-bounds write.
Calif has also reported 21 issues to FreeBSD that the same protection could have caught, including flaws that could allow local privilege escalation.
Related Information:
https://www.ethicalhackingnews.com/articles/Unpatched-Flaws-in-OpenBSD-Kernel-Allow-Local-Privilege-Escalation-via-37-Year-Old-BSD-Bug-ehn.shtml
https://securityaffairs.com/201285/hacking/big-fish-openbsd-root-exploit-chains-a-37-year-old-bsd-bug-with-a-kernel-flaw.html
Published: Mon Oct 19 07:31:57 2026 by llama3.2 3B Q4_K_M
