37-Year-Old OpenBSD Kernel Flaw Exploited for Root Access, PoC Released
A proof-of-concept exploit chaining two OpenBSD kernel flaws, one dating back 37 years, allows local privilege escalation to root, with patches now available.
A proof-of-concept exploit has been released that leverages a combination of two vulnerabilities in the OpenBSD kernel to achieve local privilege escalation to root access. The primary flaw, a significant design oversight, has roots stretching back approximately 37 years to the original BSD source code. Researchers at Calif discovered that a counter for shared memory attachment counts, named shm_nattch, was implemented using a signed 16-bit value, a limitation that has persisted for decades.
This integer overflow vulnerability allows a local user to repeatedly fork processes that utilize shared memory, thereby incrementing the shm_nattch counter beyond its maximum value of 32,767. When this limit is exceeded, the counter wraps around to a negative value. This condition can trigger a race condition, ultimately leading to a kernel use-after-free vulnerability. A second, complementary flaw then enables an out-of-bounds write, providing the exploit with sufficient control to transform memory corruption into full root privileges.
The exploit meticulously maps 127 shared memory segments, subsequently unmaps them, and then forks 259 processes to force the shm_nattch counter to wrap. The researchers then carefully shape the kernel heap memory, observing allocator statistics through sysctl(KERN_MALLOCSTATS). In a critical timing window, one process initiates the removal of a shared memory object using IPC_RMID, while a helper process simultaneously attempts to attach a new segment. Successfully winning this race condition results in a size-confused kernel allocation.
Following the confused allocation, the researchers strategically place IP socket objects in proximity to the freed memory. By manipulating the IP_MULTICAST_TTL option, they create a persistent struct ip_moptions object. The subsequent out-of-bounds write targets and modifies two membership counters within this structure. When the socket is closed, these counter changes are applied atomically, altering OpenBSD's self-referencing page-table mapping. This manipulation makes a user-space mapping accessible in supervisor mode, enabling the exploit to overwrite a predictable kernel pointer.
With the kernel pointer compromised, the exploit can then execute arbitrary code within the kernel. The attackers then repair the altered pointer to maintain system stability and establish a root shell. Notably, this exploit chain was demonstrated to function effectively even with OpenBSD's advanced security protections, including KARL (Kernel Address Randomization) and SMAP/SMEP (Supervisor Mode Access Prevention/Execution Prevention), without requiring a separate information leak vulnerability.
While KARL randomizes kernel code and data addresses at boot time, Calif identified that certain components of the kernel memory allocator exhibit predictable behavior on the same hardware. Early boot objects tend to occupy stable memory locations, allowing the exploit to target specific pointers, such as those for the lo0 and enc0 ioctl handlers.
OpenBSD has addressed these vulnerabilities through patches. The integer overflow is fixed under Errata 018, and the reference-counting use-after-free is resolved by Errata 026. The OpenBSD 7.9 errata page lists both fixes, applicable across all architectures. Binary updates are available via syspatch for amd64, i386, and arm64 systems. System administrators are strongly advised to apply all available patches and reboot their systems to activate the corrected kernel.
Calif also proposed broader security enhancements, including safe unlink checks for linked lists, random placement of page-table maps, and more unpredictable kernel allocations. Compiler-level features like array bounds checking and allocation isolation could further mitigate the exploitability of similar memory corruption bugs. The proof-of-concept exploit code is publicly accessible, highlighting the ongoing research into long-standing vulnerabilities within trusted operating system code.