An exploit capable of elevating privileges to root on OpenBSD 7.9 has been revealed, utilizing a 37-year-old integer overflow vulnerability in conjunction with a separate kernel flaw. The exploit effectively bypasses OpenBSD’s kernel-address randomization and hardware protections like SMAP and SMEP. Security firm Calif, which uncovered the vulnerabilities, shared detailed insights and proof-of-concept code following the release of patches by OpenBSD in September.
Details of the Vulnerabilities
The initial vulnerability, an integer overflow in the shmat(4) function, was addressed in errata 018, released as a reliability fix on September 14. The subsequent flaw, a reference-counting use-after-free issue, was patched separately as a security fix in errata 026, made available on September 30. Both fixes are accessible via syspatch, covering all OpenBSD architectures, with the integer overflow patch also applied to OpenBSD 7.8.
The integer overflow is viewed primarily as a reliability issue, rather than a direct security threat. No CVEs have been assigned to these vulnerabilities, and there is currently no evidence suggesting they have been exploited in real-world attacks.
Mechanics of the Exploit
The exploit manipulates the shared-memory attachment counter, shm_nattch, by mapping numerous shared-memory segments and forking hundreds of processes, ultimately causing the counter to exceed its limit and wrap into negative values. This triggers a race condition that leads to memory corruption and a use-after-free scenario.
An additional out-of-bounds write alters multicast-membership counters within the kernel. When the associated socket is closed, the decrementing of these counters results in unauthorized memory access, enabling the exploit to overwrite a function pointer and execute arbitrary code.
Proposed Security Enhancements
Despite OpenBSD’s implementation of kernel address randomization, kernel memory allocations remain predictable, as noted by researcher Andrew Griffiths. Due to the deterministic nature of the boot-time and best-fit allocators, certain kernel structures consistently occupy the same memory locations after reboots on identical hardware.
Calif has suggested several hardening strategies, including safe-unlinking of kernel linked lists, which is already utilized by FreeBSD and NetBSD, as well as further randomization of page-table mappings, kernel allocator randomization, and compiler-based bounds checking. These measures aim to bolster the security against similar exploits in the future.
The vulnerabilities were reported to OpenBSD earlier this year, and the proof-of-concept code has been made publicly available on GitHub, offering insights for security professionals and researchers.
With these updates, the OpenBSD community is actively working to address potential security gaps and enhance the robustness of its systems against evolving threats.
