Researchers Chain Two OpenBSD Flaws to Demonstrate Root Exploit
Summary
Researchers detailed an OpenBSD 7.9 local root exploit chaining a shared-memory integer overflow and a kernel use-after-free. Patches shipped in September; no CVEs were assigned, and there is no evidence of exploitation in attacks.
Key points
- The exploit targets OpenBSD 7.9 and chains a shared-memory attachment-counter overflow with a separate kernel reference-counting use-after-free.
- It maps 127 shared-memory segments and forks 259 processes to overflow the signed 16-bit counter, triggering the use-after-free through a race.
- A subsequent out-of-bounds write alters kernel multicast-membership counters; socket closure then modifies page-table entries and bypasses SMAP and SMEP.
- The exploit overwrites a function pointer at a predictable kernel address. The researchers say it requires no information-disclosure vulnerability.
- OpenBSD fixed the integer overflow in errata 018 on September 14 and the use-after-free in errata 026 on September 30; patches are available through syspatch for all architectures.
- The integer overflow was classified as a reliability fix. OpenBSD 7.8 also received that fix; neither flaw had a CVE at publication, and there is no evidence of in-the-wild use.
- Calif proposed additional hardening, including kernel allocator and page-table mapping randomization, safe-unlinking, and compiler-based bounds checking.
Article Details
- Attack Vectors
- A local privilege-escalation proof of concept chains an integer overflow in OpenBSD's shmat(4) shared-memory attachment counter with a kernel reference-counting use-after-free.
- The exploit maps 127 shared-memory segments and forks 259 processes, causing the signed 16-bit attachment counter to wrap.
- A race condition triggers the use-after-free. A separate out-of-bounds write alters kernel multicast-membership counters; closing the affected socket then modifies page-table entries to make a user-memory mapping supervisor-accessible.
- The exploit overwrites a function pointer at a predictable kernel address to execute code with root privileges, bypassing KARL, SMAP, and SMEP.
- Defensive Notes
- Apply OpenBSD errata 018 and 026 through syspatch; the article says they cover all architectures. OpenBSD 7.8 also received the integer-overflow fix.
- Calif proposed safe-unlinking for kernel linked lists, randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking as additional hardening.