Security researchers have demonstrated a local privilege escalation exploit affecting OpenBSD 7.9 that combines a decades old shared memory issue with a separate kernel vulnerability to achieve root access. Security firm Calif disclosed details of the exploit after OpenBSD released patches for both issues in September. The exploit chain combines a roughly 37 year old integer overflow in the shmat(4) shared memory attachment function with a reference counting use after free flaw in the kernel. Researchers said the technique can bypass OpenBSD security protections, including Kernel Address Randomized Link (KARL), as well as hardware based protections such as Supervisor Mode Access Prevention (SMAP) and Supervisor Mode Execution Prevention (SMEP).
The first issue involves the shared memory attachment counter known as shm_nattch, which has remained defined as a signed 16 bit short value since early BSD source code from 1988. According to Calif’s research, OpenBSD inherited this data type and did not expand its capacity, allowing the counter to exceed its maximum value of 32,767 under specific conditions. The exploit creates 127 shared memory segments and launches 259 processes, causing the counter to overflow and wrap around to a negative value. This corrupted reference count can then trigger a use after free condition, allowing memory to be released while it is still being accessed by other processes. OpenBSD addressed the integer overflow through errata 018, released on September 14, as a reliability fix. The reference counting vulnerability was addressed separately through errata 026 on September 30 as a security update. Both patches are available through the syspatch system and apply across supported architectures, while OpenBSD 7.8 also received the integer overflow correction.
The exploit chain continues by using a separate kernel memory manipulation technique that results in an out of bounds write affecting multicast membership counters. When the affected network socket is closed, the resulting changes modify page table entries and allow user memory regions to become accessible with higher privileges. This process enables the exploit to bypass SMAP and SMEP protections before modifying a predictable kernel function pointer to execute attacker controlled code. Calif researcher Andrew Griffiths explained that while OpenBSD’s KARL feature randomises kernel functions and data addresses by relinking the kernel, certain memory allocation behaviours remain predictable. According to the research, OpenBSD’s boot time and best fit memory allocators do not include base address randomisation, allowing certain early boot structures, including function pointers associated with network interface handlers, to appear at consistent locations on the same hardware. The exploit therefore does not require an information disclosure vulnerability to determine memory addresses.
Calif published the technical analysis and proof of concept code after OpenBSD released fixes for the reported issues. The researchers also suggested additional hardening measures that could further strengthen kernel security, including safe unlinking protections for kernel linked lists, randomisation of page table self referencing mappings, kernel allocator randomisation, and compiler based bounds checking. Calif reported the flaws to OpenBSD earlier in the year, and no CVE identifiers had been assigned for the issues at the time of disclosure. Researchers also noted that there is currently no evidence that the vulnerabilities have been used in active attacks. The disclosure highlights how long standing software design decisions can remain relevant in modern security research and demonstrates the importance of continuous review of operating system components, even in security focused platforms such as OpenBSD.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
