Researchers from the security firm Calif have demonstrated a local privilege escalation exploit affecting OpenBSD 7.9, leveraging a combination of a 37-year-old integer overflow vulnerability and a separate kernel flaw. This exploit successfully bypasses OpenBSD’s kernel address randomization and hardware protections, raising significant concerns about the operating system’s security posture. The findings were disclosed following the release of patches for both vulnerabilities in September 2026.
The integer overflow vulnerability, located in the shared-memory attachment function shmat(4), was addressed in OpenBSD’s errata 018, released on September 14, 2026, as a reliability fix. The subsequent reference-counting use-after-free vulnerability was patched in errata 026 on September 30, 2026, categorized as a security fix. Notably, no Common Vulnerabilities and Exposures (CVE) identifiers have been assigned to these flaws as of the publication date, and there is currently no evidence suggesting that they have been exploited in the wild.
Exploit Mechanics
The exploit takes advantage of the shm_nattch counter, which is defined as a signed 16-bit short with a maximum value of 32,767, a limitation inherited from the original BSD sources dating back to 1988. By mapping 127 shared-memory segments and forking 259 processes, the exploit pushes the counter beyond its maximum, causing it to wrap to −32,643. This overflow triggers a race condition that leads to a use-after-free scenario, where the kernel erroneously frees memory still in use by other processes.
Additionally, an out-of-bounds write modifies multicast-membership counters in the kernel. When the affected socket closes, the resulting decrements alter page-table entries, allowing user-memory mappings to become supervisor-accessible, thus bypassing the protections offered by Supervisor Mode Access Prevention (SMAP) and Supervisor Mode Execution Prevention (SMEP). The exploit ultimately overwrites a function pointer at a predictable kernel address, enabling the execution of arbitrary code.
Security Implications and Recommendations
Despite OpenBSD’s implementation of Kernel Address Randomization Layer (KARL) to randomize function and data addresses, the deterministic nature of the kernel’s memory allocators poses a significant risk. Researcher Andrew Griffiths noted that both the boot-time and best-fit allocators lack base-address randomization, resulting in predictable memory addresses across reboots on the same hardware. This predictability allows the exploit to function without requiring any information-disclosure vulnerabilities.
In light of these findings, Calif has proposed several hardening measures to enhance OpenBSD’s security. These include implementing safe-unlinking for kernel linked lists, randomizing page-table self-referential mappings, introducing kernel-allocator randomization, and employing compiler-based bounds checking. The firm reported the vulnerabilities to OpenBSD earlier this year, and the proof-of-concept exploit code is publicly available on GitHub.
As organizations continue to rely on OpenBSD for its security features, the discovery of these vulnerabilities underscores the importance of regular updates and vigilance in monitoring for potential exploits. The recent patches are crucial steps in mitigating the risks associated with these long-standing vulnerabilities.
For further details, refer to the comprehensive write-up by Calif here.
