Roughly 37 years after the shared-memory counter was first defined, researchers have published a local root exploit that chains that integer overflow with a separate kernel flaw to gain root on OpenBSD 7.9.
How the chain gains root on OpenBSD 7.9
The published exploit combines two distinct kernel flaws. The first is an integer overflow in the shmat(4) attach function that corrupts the shared-memory attachment counter, shm_nattch. The exploit maps 127 shared-memory segments and forks 259 processes, driving the counter past its signed 16-bit maximum of 32,767 and wrapping it to −32,643. A subsequent race condition triggers a reference-counting use-after-free: the corrupted count causes the kernel to free memory that other processes still use.
A separate out-of-bounds write then overwrites multicast-membership counters in the kernel; when the affected socket closes, the decrements touch page-table entries and convert a user-memory mapping into one that is supervisor-accessible. That change bypasses SMAP and SMEP hardware protections, and the exploit overwrites a function pointer at a predictable kernel address to run arbitrary code and reach root.
Technical weaknesses: a 37-year-old counter and deterministic allocators
The shared-memory attachment counter shm_nattch is defined as a signed 16-bit short with a maximum value of 32,767 in original BSD sources dating to 1988. OpenBSD inherited that type and never widened it. The integer overflow—the entry point for the full chain—was shipped as a reliability fix rather than a security fix.
Researchers from security firm Calif also highlighted why address randomization did not block exploitation. "While OpenBSD's KARL relinks the kernel binary to randomize both function and data addresses, the kernel's memory allocators remain deterministic," Andrew Griffiths wrote. The boot-time and best-fit allocators lack base-address randomization, so early-boot structures, including function pointers in the lo0 and enc0 network-interface handlers, land at the same addresses across reboots on the same hardware. Because of that deterministic placement, the exploit needs no information-disclosure vulnerability to find target function pointers.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlogOpenBSD response: errata, dates, and distribution
OpenBSD shipped two separate fixes in September. The integer overflow in shmat(4) was fixed in errata 018, released September 14 and categorized as a reliability fix; OpenBSD 7.8 also received that integer-overflow fix. The reference-counting use-after-free was fixed in errata 026, released September 30 and issued as a security fix. Both errata are available through syspatch and cover all architectures.
No CVE identifiers had been assigned for either flaw as of publication, and Calif noted there is no evidence the vulnerabilities have been used in attacks. Calif said it reported the flaws to OpenBSD "earlier this year," and published a detailed writeup plus full proof-of-concept code after OpenBSD shipped the patches; the proof-of-concept is available on GitHub.
Calif's proposed hardening categories
- Safe-unlinking for kernel linked lists — a mitigation already used by FreeBSD and NetBSD, intended to prevent linked-list corruption from producing exploitable free operations.
- Randomization of the page-table self-referential mapping — to reduce the ability of an out-of-bounds write to flip page-table entries predictably.
- Kernel-allocator randomization — to avoid deterministic placement of early-boot structures and function pointers that the exploit relies upon.
- Compiler-based bounds checking — to catch or mitigate classes of out-of-bounds writes before they reach runtime kernel memory corruption.
What this means for technologists, OpenBSD administrators, and potential attackers
- Technologists and security teams: apply errata 018 and 026 via syspatch to ensure both the integer-overflow and use-after-free fixes are installed across architectures. The integer overflow was shipped as a reliability fix, so tracking both errata is necessary to close the full chain.
- OpenBSD administrators and procurement leaders: note that OpenBSD 7.8 also received the integer-overflow fix; verify patch levels on deployed systems and confirm that syspatch has been applied where appropriate.
- Adversaries and threat actors: Calif reports no evidence the vulnerabilities have been used in attacks, but the availability of a full proof-of-concept on GitHub and the exploit’s ability to bypass KARL, SMAP, and SMEP remove several technical barriers for a local attacker who can execute the mapping and fork sequence described by the researchers.
The published chain blends a decades-old design decision with modern allocator determinism, and Calif has set a clear menu of mitigations. Whether OpenBSD will adopt the proposed allocator and mapping randomizations or compiler-enforced checks beyond the errata remains an open question for the project and its users.
