Ethical Hacking News
Calif researchers have demonstrated a local privilege escalation exploit that gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's security measures. This exploit highlights the importance of addressing reliability fixes as security vulnerabilities and underscores the need for ongoing security research and hardening measures.
OpenBSD 7.9 has a significant vulnerability due to a 37-year-old integer overflow exploit that bypasses kernel protections.The vulnerability is caused by a shared-memory attachment counter that can be pushed past its maximum value, triggering a use-after-free.The exploit takes advantage of a lack of randomization in the kernel's memory allocators, making it a challenging target for security researchers.OpenBSD 7.8 also received an integer-overflow fix, and errata are available through syspatch.Proposed hardening measures include safe-unlinking, randomization of page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking.
Recently, Calif, a security firm, published a detailed writeup and full proof-of-concept code for a local privilege escalation exploit that gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw. This exploit bypasses OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections, highlighting a significant vulnerability in the operating system. The integer overflow, the entry point for the full chain, is classified as a reliability fix, not a security fix, yet it is essential to address this issue promptly.
The shared-memory attachment counter, shm_nattch, is defined as a signed 16-bit short with a maximum value of 32,767 in the original BSD sources dating back to 1988. OpenBSD inherited this type and never widened it, which has led to a race condition when the counter is pushed past its maximum value, triggering a use-after-free. A separate out-of-bounds write overwrites multicast-membership counters in the kernel, modifying page-table entries and switching a user-memory mapping to supervisor-accessible. This bypasses SMAP and SMEP, allowing the exploit to overwrite a function pointer at a predictable kernel address to run its own code.
OpenBSD's KARL relinks the kernel binary to randomize both function and data addresses, but the kernel's memory allocators remain deterministic. This means that early-boot structures, including function pointers in the lo0 and enc0 network-interface handlers, land at the same addresses across reboots on the same hardware. The exploit needs no information-disclosure vulnerability, making it a more challenging target for security researchers.
Calif proposes four categories of hardening to address these vulnerabilities: safe-unlinking for kernel linked lists, randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking. These proposed hardening measures aim to prevent similar vulnerabilities from occurring in the future.
OpenBSD 7.8 also received the integer-overflow fix, and both errata 018 and 026 are available through syspatch, covering all architectures. It is essential to note that no CVE has been assigned for either flaw as of publication, and there is no evidence that the vulnerabilities have been used in attacks.
Calif reported the flaws to OpenBSD earlier this year, and the proof-of-concept exploit code is available on GitHub. The article highlights the importance of ongoing security research and the need for operating system vendors to address vulnerabilities promptly.
Related Information:
https://www.ethicalhackingnews.com/articles/Unraveling-the-Complexity-of-the-OpenBSD-Root-Exploit-Chaining-A-37-Year-Old-Shared-Memory-Bug-Bypassed-by-Calif-Researchers-ehn.shtml
https://thehackernews.com/2026/10/researchers-demonstrate-openbsd-root.html
https://cybersecuritynews.com/37-year-old-kernel-openbsd-flaw/
Published: Fri Oct 16 14:14:30 2026 by llama3.2 3B Q4_K_M
