OpenBSD Root Exploit Chains 37-Year-Old Shared

Security firm Calif demonstrated a local privilege escalation on OpenBSD 7.9 that combines a decades-old integer overflow in the shared-memory subsystem with a kernel use-after-free, defeating KARL randomization and SMAP/SMEP hardware protections. OpenBSD patched both flaws in September.

Security researchers at Calif published a full proof-of-concept exploit today that gains root on OpenBSD 7.9 by chaining two kernel vulnerabilities — one dating to the original 1988 BSD shared-memory implementation. The exploit bypasses OpenBSD's KARL kernel-address randomization and the SMAP and SMEP hardware protections designed to prevent user-space code from executing in kernel mode.

OpenBSD shipped fixes for both issues in September. The integer overflow in the shmat(4) attach function arrived in errata 018 on September 14, classified as a reliability fix. The reference-counting use-after-free that completes the chain was patched in errata 026 on September 30 as a security fix. Both are available through syspatch for all supported architectures, and OpenBSD 7.8 received the integer-overflow fix as well. No CVE has been assigned for either flaw, and there is no evidence of active exploitation.

A counter that never grew

The entry point is a 37-year-old design decision. The shared-memory attachment counter shm_nattch is defined as a signed 16-bit short with a maximum value of 32,767 in the original BSD sources. OpenBSD inherited the type and never widened it. The exploit maps 127 shared-memory segments and forks 259 processes, pushing the counter past its maximum and wrapping it to −32,643.

A race condition then triggers a use-after-free: the corrupted reference count causes the kernel to free memory that other processes still reference. A separate out-of-bounds write overwrites multicast-membership counters in the kernel. When the affected socket closes, the resulting decrements modify page-table entries, switching a user-memory mapping to supervisor-accessible and bypassing SMAP and SMEP. The exploit then overwrites a function pointer at a predictable kernel address to run its own code.

"While OpenBSD's KARL relinks the kernel binary to randomize both function and data addresses, the kernel's memory allocators remain deterministic," researcher Andrew Griffiths wrote in the Calif writeup. Both the boot-time and best-fit allocators lack base-address randomization, so early-boot structures — including function pointers in the lo0 and enc0 network-interface handlers — land at the same addresses across reboots on the same hardware. The exploit needs no information-disclosure vulnerability.

Beyond the two errata, Calif proposes four categories of hardening: safe-unlinking for kernel linked lists (already used by FreeBSD and NetBSD), randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking. Calif said it reported the flaws to OpenBSD earlier this year. The proof-of-concept exploit code is available on GitHub.

Source : thehackernews.com