In a report by Security Affairs, critical vulnerabilities in OpenBSD have been detailed, allowing local attackers to bypass security protections and gain root access. These flaws, one of which traces back 37 years to the original BSD code, were discovered and exploited by cybersecurity firm Calif.
The exploit chains two kernel flaws to achieve local privilege escalation on OpenBSD 7.9. The first is a 37-year-old integer overflow in the shared memory attachment counter, which, when manipulated, leads to a use-after-free vulnerability. This occurs when the counter wraps around to a negative value after exceeding its 16-bit limit, causing the kernel to free memory still in use by other processes. The second flaw involves an out-of-bounds write that corrupts multicast membership counters. When the affected socket closes, these corrupted counters modify page table entries, enabling user memory to be accessed with supervisor privileges. This bypasses hardware protections like SMAP and SMEP by exploiting errors in the kernel's memory accounting. While OpenBSD released patches in September, the exploit highlights how predictable kernel memory allocations, despite randomization efforts like KARL, can be targeted. Calif researchers suggest improvements such as safe-unlinking for kernel linked lists, randomizing page table self-referential mappings, and enabling array bounds checks in release builds to enhance security.
Source: Security Affairs
