Security researchers at Calif have published a proof-of-concept exploit that they say gives a local user root privileges on OpenBSD 7.9. The chain combines a shared-memory integer overflow, a reference-counting use-after-free and an out-of-bounds kernel write.
According to The Hacker News’ account of Calif’s research, the firm reported the flaws to OpenBSD “earlier this year” and subsequently released a detailed technical analysis and full PoC code on GitHub.
The reported attack requires local access. There is no evidence in the report that the vulnerabilities have been exploited in real-world attacks. Neither flaw had received a CVE identifier at the time of publication.
A 16-bit counter opens the exploit chain
The initial problem resides in the attach function associated with shmat(4), which connects a process to a shared-memory segment. OpenBSD tracks the number of attachments through shm_nattch, a signed 16-bit short with a maximum value of 32,767.
Calif traced that data type to BSD source code from 1988. Because the field was not widened, sufficiently increasing the attachment count can make it exceed its positive limit and wrap into a negative value.
In the researchers’ PoC, 127 shared-memory segments are mapped and 259 processes are forked. That sequence reportedly drives the counter beyond its maximum and changes its value to −32,643.
The overflow alone does not grant elevated privileges. Calif said a race condition following the wraparound leads to incorrect reference counting and a use-after-free: the kernel releases memory while other processes continue to reference it.
A separate out-of-bounds write then corrupts multicast-membership counters in the kernel. When the relevant socket closes, decrements to those counters alter page-table entries. The result, according to the researchers, is that a user-memory mapping becomes accessible in supervisor mode.
The final stage overwrites a function pointer at a predictable kernel address, allowing attacker-controlled code to execute with kernel privileges. Calif said the chain does not require a separate information-disclosure vulnerability.
Deterministic allocation weakens kernel randomization
The exploit also relies on predictable placement of kernel structures. The report says OpenBSD’s boot-time and best-fit kernel allocators do not randomize their base addresses. Early structures can therefore occupy the same locations after reboots on the same hardware.
The relevant function pointers are associated with handlers for the lo0 and enc0 network interfaces.
Researcher Andrew Griffiths explained that KARL relinks the kernel to change the positions of functions and data, while the allocators themselves remain deterministic. Calif claims its chain bypasses KARL, SMAP and SMEP.
Those findings concern different layers of protection: randomizing the kernel image does not necessarily randomize every subsequently allocated object. Predictable allocator behavior can consequently provide the exploit with stable targets even when kernel code and data have been relinked.
Fixes are available through syspatch
The shared-memory integer overflow was addressed in errata 018, shipped September 14. The report says OpenBSD categorized that update as a reliability fix rather than a security fix. It was also delivered to OpenBSD 7.8.
The use-after-free was corrected in errata 026, shipped September 30 and classified as a security fix. Both updates are available through syspatch, apply across all architectures and should be installed where applicable.
Administrators running OpenBSD 7.9 should verify that both errata 018 and 026 are present rather than treating the first update as merely an operational stability correction. OpenBSD 7.8 users should ensure they have received the applicable syspatch updates, including the errata 018 fix documented for that release.
Calif also proposed four broader defenses: safe-unlinking for kernel linked lists, randomization of the self-referential page-table mapping, kernel-allocator randomization and compiler-assisted bounds checking. These are hardening recommendations, not fixes reported as having shipped with the two errata.
