A significant security vulnerability has been discovered in OpenBSD, arising from a kernel flaw originating 37 years ago. This flaw, identified by security researchers at Calif, involves a proof-of-concept (PoC) exploit that leverages two kernel vulnerabilities to gain root access.
Details of the Kernel Vulnerability
The primary kernel bug traces back to the original BSD source code, involving a shared memory attachment counter, shm_nattch, which utilized a signed 16-bit value. This oversight allowed the flaw to persist over the decades.
Security experts at Calif noted that the flaw was addressed by OpenBSD before the exploit was made public on October 16, 2026. The published research highlights a local privilege escalation exploit, though no active exploitation in real-world scenarios has been reported.
Mechanics of the Exploit
The first flaw pertains to System V shared memory handling. By continuously forking processes linked to shared memory records, a local user could exceed the counter’s maximum value of 32,767, causing it to wrap to a negative number. This integer overflow triggers a race condition, resulting in a kernel use-after-free scenario.
The second flaw involves a conditional out-of-bounds write, allowing researchers to manipulate memory corruption into root access. Calif’s method involves mapping 127 shared memory segments, removing their mappings, and forking 259 processes to force the counter to wrap.
Subsequently, kernel heap memory is configured, and allocator data monitored through sysctl(KERN_MALLOCSTATS). This complex process ultimately permits code execution in the kernel, leading to root shell access.
OpenBSD’s Response and Future Outlook
OpenBSD has rectified the integer overflow via Errata 018 and the reference-counting use-after-free through Errata 026. The OpenBSD 7.9 errata page details these fixes, with binary updates available for all architectures, urging administrators to apply the patches and reboot systems.
Calif’s research advocates for broader protections, such as implementing safe unlink checks for linked lists, randomizing page-table map placements, and making kernel allocations less predictable. These measures, alongside compiler enhancements like array bounds checks, could mitigate similar vulnerabilities in the future.
Publicly accessible, the PoC source code is part of Calif’s MAD Bugs research initiative. This case underscores the persistence of ancient design flaws within trusted operating systems, echoing past discoveries like a 27-year-old OpenBSD authentication flaw.
While endpoint detection and response (EDR) alerts can indicate attacks, comprehensive understanding requires reconstructing the entire attack timeline.
