Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug
Summary: Security firm Calif published a local privilege escalation exploit that gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow in the shmat(4) attach function with a separate reference-counting use-after-free, bypassing KARL address randomization and SMAP and SMEP protections. OpenBSD patched the overflow in errata 018 on September 14 as a reliability fix and the use-after-free in errata 026 on September 30 as a security fix, with no CVE assigned and no evidence of exploitation in attacks.
What you should know: The entry point to the full chain was shipped as a reliability fix rather than a security fix, and the shm_nattch counter that enabled it is a signed 16-bit short capped at 32,767, inherited from 1988 BSD sources and never widened. Calif's writeup notes that while KARL randomizes function and data addresses, the kernel's memory allocators remain deterministic, so the exploit needs no information-disclosure vulnerability.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026