A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped patches for both issues in September.
The integer overflow in the shmat(4) attach function was fixed in errata 018, shipped September 14 as a reliability fix. The reference-counting use-after-free that completes the chain was fixed separately in errata 026, shipped September 30 as a security fix.
Both are available through syspatch and cover all architectures. OpenBSD 7.8 also received the integer-overflow fix.
The integer overflow, the entry point for the full chain, is classified as a reliability fix, not a security fix.
No CVE has been assigned for either flaw as of publication. There is no evidence that the vulnerabilities have been used in attacks.
The shared-memory attachment counter shm_nattch is defined as a signed 16-bit short with a maximum value of 32,767 in original BSD sources dating to 1988. OpenBSD inherited the type and never widened it.
The exploit maps 127 shared-memory segments and forks 259 processes, pushing the counter past its maximum and wrapping it to −32,643. A race condition then triggers a use-after-free: the corrupted reference count causes the kernel to free memory that other processes still use.
A separate out-of-bounds write overwrites multicast-membership counters in the kernel. When the affected socket closes, the resulting decrements modify page-table entries, switching a user-memory mapping to supervisor-accessible and bypassing SMAP and SMEP. The exploit then overwrites a function pointer at a predictable kernel address to run its own code.
"While OpenBSD's KARL relinks the kernel binary to randomize both function and data addresses, the kernel's memory allocators remain deterministic," researcher Andrew Griffiths wrote. Both the boot-time and best-fit allocators lack base-address randomization, so early-boot structures, including function pointers in the lo0 and enc0 network-interface handlers, land at the same addresses across reboots on the same hardware. The exploit needs no information-disclosure vulnerability.
Beyond the two errata, Calif proposes four categories of hardening: safe-unlinking for kernel linked lists (already used by FreeBSD and NetBSD), randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking.
Calif said it reported the flaws to OpenBSD "earlier this year." The proof-of-concept exploit code is available on GitHub.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.