{"id":632661,"date":"2026-10-16T18:30:15","date_gmt":"2026-10-16T18:30:15","guid":{"rendered":"https:\/\/www.newsbeep.com\/nz\/632661\/"},"modified":"2026-10-16T18:30:15","modified_gmt":"2026-10-16T18:30:15","slug":"researchers-demonstrate-openbsd-root-exploit-chaining-37-year-old-shared-memory-bug","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/nz\/632661\/","title":{"rendered":"Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug"},"content":{"rendered":"

\ue804Swati Khandelwal\ue802Oct 16, 2026Vulnerability \/ OpenBSD<\/p>\n

\"\"<\/a><\/p>\n

A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD’s KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup<\/a> and full proof-of-concept code after OpenBSD shipped patches for both issues in September.<\/p>\n

The integer overflow in the shmat(4) attach function was fixed in errata 018<\/a>, shipped September 14 as a reliability fix. The reference-counting use-after-free that completes the chain was fixed separately in errata 026, shipped September 30 as a security fix.<\/p>\n

Both are available through syspatch and cover all architectures. OpenBSD 7.8 also received the integer-overflow fix.<\/p>\n

The integer overflow, the entry point for the full chain, is classified as a reliability fix, not a security fix.<\/p>\n

No CVE has been assigned for either flaw as of publication. There is no evidence that the vulnerabilities have been used in attacks.<\/p>\n

The shared-memory attachment counter shm_nattch is defined as a signed 16-bit short with a maximum value of 32,767 in original BSD sources<\/a> dating to 1988. OpenBSD inherited the type and never widened it.<\/p>\n

The exploit maps 127 shared-memory segments and forks 259 processes, pushing the counter past its maximum and wrapping it to \u221232,643. A race condition then triggers a use-after-free: the corrupted reference count causes the kernel to free memory that other processes still use.<\/p>\n

A separate out-of-bounds write overwrites multicast-membership counters in the kernel. When the affected socket closes, the resulting decrements modify page-table entries, switching a user-memory mapping to supervisor-accessible and bypassing SMAP and SMEP. The exploit then overwrites a function pointer at a predictable kernel address to run its own code.<\/p>\n

“While OpenBSD’s KARL relinks the kernel binary to randomize both function and data addresses, the kernel’s memory allocators remain deterministic,” researcher Andrew Griffiths wrote. Both the boot-time and best-fit allocators lack base-address randomization, so early-boot structures, including function pointers in the lo0 and enc0 network-interface handlers, land at the same addresses across reboots on the same hardware. The exploit needs no information-disclosure vulnerability.<\/p>\n

Beyond the two errata, Calif proposes four categories of hardening: safe-unlinking for kernel linked lists (already used by FreeBSD and NetBSD), randomization of the page-table self-referential mapping, kernel-allocator randomization, and compiler-based bounds checking.<\/p>\n

Calif said it reported the flaws to OpenBSD “earlier this year.” The proof-of-concept exploit code<\/a> is available on GitHub.<\/p>\n","protected":false},"excerpt":{"rendered":"\ue804Swati Khandelwal\ue802Oct 16, 2026Vulnerability \/ OpenBSD A local privilege escalation exploit published today gains root on OpenBSD 7.9…\n","protected":false},"author":2,"featured_media":632662,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[111,139,69,145],"class_list":["post-632661","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-new-zealand","tag-newzealand","tag-nz","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/632661","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=632661"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/632661\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/632662"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=632661"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=632661"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=632661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}