Researchers Publish Working OpenBSD Root Exploit Built on a 37-Year-Old Bug

A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining two kernel flaws. The first is an integer overflow in the shared-memory attach function, rooted in a counter type defined in original BSD sources from 1988. The second is a separate reference-counting use-after-free. Together they get around OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, released a detailed writeup and proof-of-concept code after patches shipped.

Both issues were fixed in September. The integer overflow was addressed in errata 018 on September 14 and classed as a reliability fix, not a security fix, even though it is the entry point for the full chain. The use-after-free was fixed in errata 026 on September 30 as a security fix. Both patches are available through syspatch and cover all architectures, and OpenBSD 7.8 also received the integer-overflow fix. No CVE has been assigned for either flaw, and there is no evidence they have been used in attacks.

Researcher Andrew Griffiths noted that although KARL randomizes the kernel binary, the kernel's memory allocators remain deterministic. Key structures land at the same addresses across reboots on the same hardware, so the exploit needs no separate information-disclosure bug. Because the exploit is local, an attacker would first need a foothold on the system.