TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security researchers at Calif reported an OpenBSD vulnerability rooted in a signed 16-bit shared-memory counter present in the BSD source history for about 37 years. Calif says it combined the counter overflow with a separate kernel out-of-bounds write to gain local root access, and reports that OpenBSD addressed the issues in errata 026 and 018. The report describes an exploit against mitigations, but does not establish that the flaws were used in attacks or provide enough information here to assess affected versions and patch deployment.
Security researchers at Calif say they developed a way to gain root access on OpenBSD by combining a shared-memory counter overflow that dates to the original BSD sources with a separate kernel out-of-bounds write. Calif says the issues were addressed in OpenBSD errata 026 and 018; its report describes a local exploit that worked with several protections enabled.
The older flaw involved shm_nattch, a shared-memory attachment counter defined as a signed 16-bit short. Calif says repeated process forking could push the counter beyond its maximum positive value of 32,767, making it wrap to a negative number. In combination with a race condition, that could lead to a use-after-free. The researchers paired this with a separate kernel out-of-bounds write to build a route to elevated privileges.
Calif says its exploit reached kernel code execution and a root shell without an information-disclosure vulnerability, while OpenBSD protections including KARL, SMAP and SMEP were enabled. The report outlines a complex sequence involving shared-memory segments, process forking, heap allocation timing and network sockets. It says the researchers used a conditional out-of-bounds write and later socket cleanup to alter kernel memory. These are details of Calif’s reported research, not evidence that the technique has been used in real-world attacks.
According to Calif, the shared-memory issue and the separate write flaw were handled in errata 026 and 018, respectively. The report also discusses mitigations beyond those fixes, including checks on linked-list operations and greater randomization in kernel memory layouts. Those are presented as possible defensive measures; the source does not say they have all been adopted by OpenBSD.
How the Exploit Bypassed Protections
The report matters because it shows how a small, old accounting bug can become more serious when combined with a separate memory-corruption flaw. Calif’s account also illustrates that security features such as kernel address randomization and hardware protections do not necessarily prevent exploitation when other kernel structures remain predictable and a suitable write primitive is available.
For OpenBSD users, the immediate practical point is to consult the project’s errata and apply relevant fixes, rather than relying on general claims about the operating system’s defenses. For kernel developers, the researchers’ recommendations highlight potential safeguards against similar failure chains: validate linked-list invariants before unlinking entries, reduce predictability in memory allocation and page-table layouts, and consider compiler checks for certain out-of-bounds accesses. Calif describes these as approaches that could reduce risk, not as proof that all related vulnerabilities are eliminated.
As an affiliate, we earn on qualifying purchases.
Calif says the counter’s definition can be traced roughly 37 years to the original BSD sources. A signed 16-bit value has a limited positive range, so operations that exceed that range can change how later code interprets the value. In this case, the researchers say the wraparound affected shared-memory accounting and helped create a use-after-free race.
The exploit report describes a second key ingredient: predictable kernel allocations. Calif says KARL relinks the kernel to randomize function and data addresses, but the allocators it examined remained deterministic in relevant ways. It says predictable kernel pointers helped make the final control-flow step possible. This is the researchers’ technical analysis of the described exploit, not a broad finding that all OpenBSD kernel allocations are predictable or exploitable.
““Big fish. Small counter. Root shell.””
— Calif
kernel vulnerability detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Affected Releases and Exploit Exposure
The supplied report does not identify the affected OpenBSD releases, the dates of errata 026 and 018, or the precise versions in which each fix shipped. It also does not provide evidence that the exploit was used outside Calif’s research or that systems were compromised. The exact relationship between the two errata and the full set of affected configurations should be checked against the OpenBSD advisories themselves.
Calif discusses additional defensive changes, but the source does not confirm whether OpenBSD implemented them. The report also does not establish how likely exploitation would be in ordinary conditions; its described method requires local access and a carefully arranged sequence of kernel operations.
As an affiliate, we earn on qualifying purchases.
Check Errata and Mitigation Status
OpenBSD users and administrators should review errata 026 and 018 and apply the fixes relevant to their installed release, following the project’s official instructions. The source material does not state whether further patches or design changes are planned, so any additional mitigation work should be treated as unconfirmed unless OpenBSD announces it.
Further reporting should clarify the affected release range, patch availability by version, and whether the project has considered Calif’s proposals for safe unlinking or allocator and page-table randomization. Until then, the confirmed development is the researchers’ published exploit account and their statement that the two reported issues were addressed through errata.
privilege escalation testing tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What was the OpenBSD bug?
Calif says a signed 16-bit shared-memory attachment counter could overflow after repeated process forking. The resulting negative value could contribute to a race and use-after-free.
How did Calif say it reached root access?
The researchers say they combined the counter flaw with a separate kernel out-of-bounds write, then used a carefully arranged sequence of memory and socket operations to obtain kernel code execution and a root shell.
Were OpenBSD users attacked with this exploit?
The source report describes Calif’s research exploit but provides no evidence of real-world attacks or compromised systems.
Have the vulnerabilities been fixed?
Calif says OpenBSD addressed the shared-memory issue and the separate write flaw in errata 026 and 018, respectively. Check official OpenBSD errata for applicable releases and patch instructions.
Are the additional mitigations already in OpenBSD?
The report proposes measures such as safe unlinking and more memory-layout randomization, but does not confirm that OpenBSD adopted them. Their status remains unclear from the source material.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
